SQL Injection in Open Ises Tickets
CVE-2026-48239
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.
Vulnerability class: SQL Injection
EPSS: 0.002 (11.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Open Ises Tickets — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-48239?
- CVE-2026-48239 is a high-severity vulnerability in Open Ises Tickets, classified under SQL Injection. CVSS score: 7.1/10. Published 2026-05-21.
- How severe is CVE-2026-48239?
- High severity. CVSS v3 base score is 7.1 out of 10.