CVE-2026-35007 is a reflected cross-site scripting vulnerability in openises tickets before version 3.44.2. The issue exists in single_unit.php where the id GET parameter is passed unsanitized directly into an HTML attribute, enabling authenticated attackers to inject arbitrary JavaScript code. This can lead to script execution in the context of the victim's browser when they visit a maliciously crafted URL. The vulnerability has a CVSS 4.0 score of 5.1 (medium severity). No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation must be managed by the user.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser by tricking them into visiting a malicious URL. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of reflected XSS vulnerabilities. However, the attack requires user interaction and authentication, limiting the scope somewhat. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block malicious input in the id parameter. Avoid clicking on suspicious links containing unexpected parameters. Monitor vendor channels for updates and apply patches promptly once available.