CVE-2026-35013 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue exists in street_view.php, where thelat and thelng GET parameters are directly inserted into JavaScript variables without proper input neutralization. Authenticated attackers can exploit this by crafting URLs containing malicious JavaScript payloads that execute in the context of the victim's browser upon visiting the URL. This vulnerability can lead to script execution but requires user interaction and authentication. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts depending on the injected script. The vulnerability requires user interaction and authentication, which limits the attack scope. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking on suspicious URLs containing thelat and thelng parameters in Open ISES Tickets. Implementing input validation or sanitization on these parameters can mitigate the risk. Monitoring for updates from the vendor is recommended.