PT-2026-42517 · Openises · Tickets

Ejosterberg · Published 2026-05-21 · Updated 2026-05-21 · CVE-2026-48239

Mitre

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-48239

Affected Products

Tickets

References · 4

• https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-48239 · Security Note
• https://github.com/openises/tickets/releases/tag/v3.44.2 · Note
• https://vulncheck.com/advisories/open-ises-tickets-sql-injection-via-ajax-reports-php-tick-id-parameter · Note