CVE-2026-35008 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. The issue exists in the single.php file where the ticket_id GET parameter is incorporated into an HTML attribute without proper input neutralization. Authenticated attackers can exploit this by crafting a malicious URL that injects JavaScript code, which executes in the context of the victim's browser upon visiting the URL. This vulnerability can lead to script execution but requires user interaction and authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser session. This could lead to actions such as session hijacking, defacement, or other client-side attacks within the context of the affected application. However, the attack requires the victim to be authenticated and to visit a maliciously crafted URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs containing the ticket_id parameter and avoid clicking on suspicious links. Application administrators should monitor for updates from the vendor and apply patches promptly once available.