CVE-2026-48230 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in ticketsmdb_import.php, where several POST parameters (mdbhost, mdbdb, mdbuser, mdbpassword, mdbprefix, ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix) are directly inserted into HTML hidden input values without proper neutralization. Authenticated attackers can exploit this to inject JavaScript that executes in the context of the victim's browser upon rendering the affected page.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session hijacking, unauthorized actions on behalf of the victim, or other client-side attacks. The vulnerability requires authentication and user interaction (rendering the malicious response). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected functionality to trusted users only and consider additional input validation or output encoding controls if possible. Monitor vendor communications for updates regarding patches or official mitigations.