CVE-2026-35011 is a reflected cross-site scripting vulnerability in Open ISES Tickets affecting versions prior to 3.44.2. The issue exists in the opena.php file where the frm_call GET parameter is not properly neutralized, allowing authenticated attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser. This can be exploited by crafting a malicious URL containing the JavaScript payload in the frm_call parameter. The vulnerability requires user interaction (visiting the malicious URL) and authentication, and it does not involve elevated privileges or direct system compromise.

An attacker who is authenticated can exploit this vulnerability to execute arbitrary JavaScript in the context of a victim's browser. This could lead to session hijacking, unauthorized actions performed on behalf of the victim, or other client-side attacks. However, the vulnerability does not allow privilege escalation or direct compromise of the server. The impact is limited to the browser session of users who visit the malicious URL.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor vendor communications for updates. In the meantime, restricting access to trusted users and educating users about the risks of clicking untrusted links may reduce exposure. Once a patch is released, promptly apply the update to versions 3.44.2 or later.