CVE-2026-35011 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in the opena.php file where the frm_call GET parameter is incorporated into the page output without proper neutralization or sanitization. Authenticated attackers can exploit this by crafting a URL with malicious JavaScript in the frm_call parameter, which executes in the context of the victim's browser upon visiting the URL. This vulnerability can lead to script execution but requires user interaction and authentication. The CVSS 4.0 score is 5.1 (medium severity). No vendor advisory or patch information is currently available.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when the victim accesses a maliciously crafted URL. This can lead to session hijacking, defacement, or other client-side attacks depending on the injected script. However, exploitation requires the attacker to be authenticated and the victim to interact with the malicious URL. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs containing the frm_call parameter and restrict access to trusted users. Monitoring for suspicious URL usage may help detect attempted exploitation. Avoid clicking on untrusted links that target the affected application.