CVE-2026-35012 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue exists in add_facnote.php, where the ticket_id GET parameter is directly embedded into a hidden input field's VALUE attribute without proper input neutralization. Authenticated attackers can exploit this by crafting a malicious URL that injects JavaScript code, which executes in the context of the victim's browser upon visiting the URL. This vulnerability could be used to perform actions such as session hijacking or other client-side attacks relying on script execution. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when the victim visits a maliciously crafted URL. This can lead to typical reflected XSS impacts such as session hijacking, defacement, or other client-side attacks. The vulnerability requires the attacker to be authenticated and the victim to interact with the malicious link. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with URLs containing the ticket_id parameter and avoid clicking untrusted links. Implementing input validation or output encoding on the ticket_id parameter in add_facnote.php would mitigate this issue. Monitoring vendor channels for an official patch is recommended.