CVE-2026-35011 is a reflected cross-site scripting vulnerability in Open ISES Tickets before version 3.44.2. The issue exists in the opena.php file where the frm_call GET parameter is directly embedded into the web page output without proper input neutralization. Authenticated attackers can exploit this by crafting URLs with malicious JavaScript payloads in the frm_call parameter, which execute in the context of the victim's browser upon visiting the URL. This vulnerability can lead to script execution but requires user interaction and authentication.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to actions such as session hijacking, unauthorized actions on behalf of the victim, or other client-side attacks. However, the attack requires the victim to be authenticated and to visit a maliciously crafted URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on untrusted links containing suspicious frm_call parameters and restrict access to the affected application to trusted users. Monitor vendor channels for updates regarding patches or official mitigations.