CVE-2026-35010 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. The flaw exists in patient_JF.php where the ticket_id GET parameter is directly inserted into a JavaScript variable assignment without proper input neutralization. Authenticated attackers can craft URLs that execute arbitrary JavaScript in the context of the victim's browser upon visiting the URL. This vulnerability could be leveraged to perform actions such as session hijacking or other client-side attacks if exploited. The CVSS 4.0 score is 5.1 (medium severity), with no privileges required but user interaction needed. No vendor patch or official remediation is currently documented.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser when they visit a maliciously crafted URL. This can lead to typical reflected XSS impacts such as theft of session tokens, manipulation of web content, or other client-side attacks. The vulnerability requires user interaction and authentication, which limits the attack scope. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted URLs containing the ticket_id parameter. Web application developers should implement proper input validation and output encoding for the ticket_id parameter to prevent script injection. Monitoring for suspicious URLs and educating users about phishing risks may reduce exposure.