CVE-2026-35011

Open ISES Tickets prior to 3.44.2 is affected by a reflected XSS in opena.php via the frm_call parameter. An authenticated attacker can craft a URL containing an unsanitized frm_call value that is reflected in page output, allowing arbitrary JavaScript execution in the victim’s browser. A fix is ...