Which versions of Open ISES Tickets are affected by CVE-2026-48232?

Open ISES Tickets versions prior to 3.44.2 contain a SQL injection vulnerability allowing authenticated users to read, modify, or destroy database contents, directly threatening organizational data…. A patch is available.

How to fix or mitigate CVE-2026-48232?

Within 24 hours: Inventory all Open ISES Tickets instances and document current versions; identify systems running pre-3.44.2 releases. Within 7 days: Test and validate Open ISES Tickets version 3.44.2 in a staging environment for compatibility. Within 30 days: Deploy Open ISES Tickets 3.44.2 to all production systems and confirm successful patch application.

Open ISES Tickets CVE-2026-48232

Q: What is the CVSS score of CVE-2026-48232?

CVE-2026-48232 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31314 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-8jmr-cmr6-c62j

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:33 vuln.today

Analysis Generated

May 21, 2026 - 18:33 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate database queries through the unsanitized offset parameter in ajax/fullsit_incidents.php. The flaw enables reading, modifying, or destroying database contents and is part of a broader v3.44.2 security release that patched 19 SQL injection issues. No public exploit identified at time of analysis, but the vendor classifies the update as critical and urges immediate upgrade.

Technical ContextAI

Open ISES Tickets is a PHP-based incident ticketing application (CPE: cpe:2.3:a:open_ises:tickets) used for tracking incidents, commonly deployed with MariaDB/MySQL backends. The vulnerability is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where the GET parameter 'offset' is concatenated directly into the LIMIT clause of a SELECT statement rather than passed as a bound parameter or numerically cast. Because LIMIT-clause injection in MySQL/MariaDB permits UNION and stacked-query manipulation via crafted numeric expressions, attackers can extend the query beyond the intended row pagination to extract or modify arbitrary database contents.

RemediationAI

Vendor-released patch: 3.44.2 - upgrade immediately by downloading the release from https://github.com/openises/tickets/releases/tag/v3.44.2 or running 'docker compose pull && docker compose up -d' for Docker deployments; the specific code fix is at commit ecfeb406a016766cae81c749e14b5145a9f2dbff. Because this release also removes hardcoded API keys and database passwords from the codebase, operators should rotate any credentials previously stored in the application and review SSL/file-permission settings after upgrade. If upgrade is not immediately possible, restrict access to /ajax/fullsit_incidents.php via web server rules (e.g., deny on the offset parameter containing non-digit characters with mod_security or an equivalent WAF rule), enforce strong authentication and audit existing accounts (default admin/admin Docker credentials must be changed), and place the application behind a VPN or IP allowlist; note that WAF filters on LIMIT-clause injection can be bypassed by encoding tricks, so this is a stopgap only.