Reflected Cross-Site Scripting Vulnerability in Open ISES Tickets by Open ISES

CVE-2026-35010

What is CVE-2026-35010?

The Open ISES Tickets application contains a reflected cross-site scripting vulnerability located in the patient_JF.php file. This flaw allows authenticated attackers to inject arbitrary JavaScript by manipulating the ticket_id GET parameter, which is unsanitized. By crafting a malicious URL with a JavaScript payload, an attacker can execute the script in the victim's browser when they access the compromised URL. This can lead to session hijacking, data theft, or other malicious activities, underscoring the importance of applying the latest security patches.

References