CVE-2018-25404 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25403 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25402 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25401 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25400 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25399 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2018-25398 | High | 8.2 | 2026-05-29 | The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicio… |
CVE-2026-48249 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setti… |
CVE-2026-48248 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT… |
CVE-2026-48247 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CUR… |
CVE-2026-48246 | Medium | 5.9 | 2026-05-21 | Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_S… |
CVE-2026-48245 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracte… |
CVE-2026-48244 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be ex… |
CVE-2026-48243 | Medium | 5.3 | 2026-05-21 | Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor wit… |
CVE-2026-48242 | High | 8.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The crede… |
CVE-2026-48241 | High | 8.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source… |
CVE-2026-48240 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated… |
CVE-2026-48239 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clau… |
CVE-2026-48238 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause… |
CVE-2026-48237 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated… |
CVE-2026-48236 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser… |
CVE-2026-48235 | High | 8.2 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestam… |
CVE-2026-48234 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated… |
CVE-2026-48233 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT… |
CVE-2026-48232 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LI… |
CVE-2026-48231 | High | 7.1 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are conc… |
CVE-2026-48230 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject… |
CVE-2026-48229 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48228 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48227 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48226 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48225 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary Ja… |
CVE-2026-48224 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48223 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48222 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48221 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary… |
CVE-2026-48220 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48219 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48218 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to injec… |
CVE-2026-48217 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbi… |
CVE-2026-48216 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrar… |
CVE-2026-48215 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48214 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary J… |
CVE-2026-48213 | Medium | 5.4 | 2026-05-21 | Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary Java… |