CVE-2026-48240: high-severity vulnerability in Open ISES Tickets
Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.4%
exploitation probability
0.4%top 73% of all CVEs
observed exploitation
nono source reports it
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
Open ISES · TicketsRelated CVEs — Open ISES Tickets
In the same product, most dangerous first.
CVE-2026-48241CRITICALOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.phpEPSS 0.5%CVE-2026-48242CRITICALOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.phpEPSS 0.5%CVE-2026-48235HIGHOpen ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker DataEPSS 0.4%CVE-2026-48245MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.phpEPSS 0.4%CVE-2026-48244MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.phpEPSS 0.4%CVE-2026-48243MEDIUMOpen ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.phpEPSS 0.4%