CVE-2026-35010 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in patient_JF.php where the ticket_id GET parameter is directly inserted into a JavaScript variable assignment without proper input neutralization. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the ticket_id parameter, which executes in the context of the victim's browser upon visiting the URL. This can lead to script execution but requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when the victim visits a maliciously crafted URL. This can lead to session hijacking, unauthorized actions, or other client-side impacts typical of reflected XSS vulnerabilities. The vulnerability does not require elevated privileges but does require user interaction and authentication. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs containing ticket_id parameters and restrict access to trusted users only. Monitoring for suspicious URLs and educating users about phishing risks may help reduce exposure. Avoid sharing URLs with untrusted parties. Once a vendor patch or update is released, apply it promptly.