SQL Injection in Open Ises Tickets
CVE-2026-48235
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitude integration) are concatenated into UPDATE and INSERT statements without sanitization. An attacker able to compromise or impersonate the remote GPS tracker endpoint can inject SQL to manipulate the responder location, tracks, and assignment tables.
Vulnerability class: SQL Injection
EPSS: 0.002 (15.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Open Ises Tickets — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-48235?
- CVE-2026-48235 is a high-severity vulnerability in Open Ises Tickets, classified under SQL Injection. CVSS score: 8.2/10. Published 2026-05-21.
- How severe is CVE-2026-48235?
- High severity. CVSS v3 base score is 8.2 out of 10.