CVE-2026-35016 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue arises because the frm_query POST parameter is directly embedded into the VALUE attribute of an HTML input field in search.php without proper neutralization or sanitization. Authenticated attackers can exploit this by sending a specially crafted request containing malicious JavaScript code, which executes in the context of the victim's browser when the input is rendered. This can lead to client-side script execution, potentially enabling session hijacking or other client-side attacks.

An authenticated attacker can execute arbitrary JavaScript in the context of a victim's browser by exploiting the reflected XSS vulnerability. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the victim user. The vulnerability requires authentication and user interaction (submission of the crafted request). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor vendor communications for updates. In the meantime, limit exposure by restricting access to trusted users and consider applying web application firewall (WAF) rules to detect and block malicious payloads targeting the frm_query parameter.