Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-48239: Open ISES Tickets 3.44.2 allows database manipulation via report request

CVE-2026-48239 · published 5 months ago

Summary

Versions of Open ISES Tickets older than 3.44.2 let a signed‑in user change the content of a web request that builds a database query for the incident summary report. Because the request data isn’t checked, an attacker could read, change, or delete information stored in the ticket database. Upgrade to version 3.44.2 or later, or apply a patch that validates and escapes the report parameters.

Original advisory text

Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48239... Vendor Advisory
https://github.com/openises/tickets/releases/tag/v3.44.2 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-48239 Vendor Advisory
https://www.vulncheck.com/advisories/open-ises-tickets-sql-injection-via-ajax-re... Vendor Advisory
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2d... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published21 May 2026

Updated29 Oct 2026

First seen21 May 2026

Sources

CVE-2026-48239 · NVD

CVE-2026-48239 · OSV

Track software like this

Free during beta