CVE-2026-35016 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue arises because the frm_query POST parameter is directly inserted into an HTML input field's VALUE attribute without proper neutralization or sanitization. Authenticated attackers can exploit this by crafting a malicious request containing JavaScript payloads that execute in the context of the victim's browser upon submission. This vulnerability can lead to script execution, potentially enabling session hijacking or other client-side attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the victim's browser, which can lead to client-side attacks such as session hijacking or unauthorized actions performed with the victim's privileges. The vulnerability is limited to authenticated users and requires user interaction to trigger the malicious script. There is no indication of direct impact on server integrity or confidentiality beyond the client-side context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor the vendor's communications for updates. In the meantime, restricting access to trusted users and avoiding submission of untrusted input in the frm_query parameter may reduce risk. Avoiding use of vulnerable versions or upgrading once a patch is released is recommended.