CVE-2026-35011

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description A reflected cross-site scripting issue exists in the 'opena.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the frm call GET parameter, which is then rendered directly in the page output. This allows the execution of malicious scripts in the victim's browser when a specially crafted URL is visited.

Recommendations Update to version 3.44.2 or later. As a temporary mitigation, restrict access to the 'opena.php' endpoint or avoid using the frm call parameter until the update is applied.