CVE-2026-35016 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets before version 3.44.2. The issue arises because the frm_query POST parameter is directly embedded into the VALUE attribute of an HTML input field in search.php without proper neutralization or sanitization. Authenticated attackers can exploit this by crafting a malicious request that injects JavaScript code, which executes in the context of the victim's browser upon form submission. This vulnerability requires user interaction and authentication but does not require elevated privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low scope impact.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or other client-side impacts typical of reflected XSS vulnerabilities. However, the attack requires the victim to submit the malicious input, limiting the scope of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. In the meantime, restricting access to trusted users and exercising caution with input handling may reduce risk. Avoid submitting untrusted input through the frm_query parameter until a fix is available.