CVE-2026-35007 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue exists in the single_unit.php file where the id GET parameter is directly inserted into an HTML attribute without proper neutralization. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the id parameter, which executes in the context of the victim's browser upon visiting the URL. This vulnerability can lead to client-side script execution, potentially enabling session hijacking or other browser-based attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session when the victim accesses a maliciously crafted URL. This can lead to theft of sensitive information, session hijacking, or other client-side attacks. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is documented, users should monitor the vendor's communications for updates. In the meantime, restricting access to trusted users and educating users about suspicious URLs may reduce risk. Avoid sharing or clicking untrusted links containing the id parameter until a fix is available.