CVE-2026-35008 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue arises because the ticket_id GET parameter in single.php is improperly neutralized, allowing an authenticated attacker to inject JavaScript code directly into an HTML attribute. This can lead to script execution in the context of the victim's browser when they access a maliciously crafted URL. The vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser, potentially leading to session hijacking, unauthorized actions, or data disclosure within the affected application. However, the attack requires the victim to visit a malicious URL and the attacker to be authenticated, which limits the scope and ease of exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when clicking on URLs containing ticket_id parameters and consider restricting access to the affected application to trusted users only. Monitoring for suspicious URLs and educating users about phishing risks related to this vulnerability is advisable. Once a patch or official mitigation is available from the vendor, it should be applied promptly.