CVE-2026-35013

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description A reflected cross-site scripting issue exists in the 'street view.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the thelat and thelng GET parameters, which are passed directly into JavaScript variable assignments. This allows the execution of a malicious payload in the victim's browser when a specially crafted URL is visited.

Recommendations Update to version 3.44.2 or later. As a temporary mitigation, restrict access to the 'street view.php' endpoint or avoid using the thelat and thelng parameters.