The vulnerability in Open ISES Tickets (CVE-2026-35010) is a reflected cross-site scripting issue in the patient_JF.php file. Authenticated attackers can exploit this by supplying a specially crafted ticket_id parameter in a URL, which is directly assigned to a JavaScript variable without proper input neutralization. This allows execution of arbitrary JavaScript in the context of the victim's browser session when the malicious URL is accessed. The affected versions include all versions prior to 3.44.2. No official patch or remediation level has been indicated in the available data.

Successful exploitation enables an attacker to execute arbitrary JavaScript code in the context of an authenticated user's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, or other client-side attacks. The vulnerability requires the attacker to be authenticated and to trick a user into visiting a malicious URL containing the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing the ticket_id parameter. Implementing input validation and output encoding on the ticket_id parameter on the server side is recommended once a patch is available.