CVE-2026-35008 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the single.php file where the ticket_id GET parameter is used without proper input neutralization, allowing authenticated attackers to inject arbitrary JavaScript code into an HTML attribute. This can lead to script execution in the context of the victim's browser when they visit a maliciously crafted URL containing the payload. The vulnerability requires authentication but does not require user interaction beyond visiting the URL. No official patch or remediation level has been documented in the available data.

An authenticated attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a victim's browser by tricking the victim into visiting a malicious URL. This could lead to session hijacking, defacement, or other client-side attacks depending on the injected script. The vulnerability is limited to authenticated users and requires the victim to visit the malicious link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing ticket_id parameters. Administrators should monitor for updates from the vendor regarding patches or official mitigations. No temporary or official fix is currently documented.