CVE-2026-35013 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue exists in street_view.php where thelat and thelng GET parameters are directly inserted into JavaScript variables without proper input neutralization. Authenticated attackers can exploit this by crafting URLs containing malicious JavaScript payloads in these parameters, which execute in the context of the victim's browser upon visiting the URL. The vulnerability allows execution of arbitrary scripts, potentially leading to session hijacking or other client-side attacks. The CVSS 4.0 score is 5.1 (medium severity). No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when the victim visits a maliciously crafted URL. This can lead to client-side attacks such as session hijacking or unauthorized actions performed on behalf of the victim. However, the attack requires the victim to be authenticated and to visit the malicious URL. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on URLs containing thelat and thelng parameters in Open ISES Tickets. Restricting access to trusted users and monitoring for suspicious URLs may help reduce risk. Avoid sharing URLs with these parameters externally. Follow vendor updates for any forthcoming patches or official mitigations.