Which versions of Open ISES Tickets are affected by CVE-2026-48235?

Open ISES Tickets before v3.44.2 contains a SQL injection vulnerability exploitable without authentication, allowing attackers to access and manipulate the entire database including all tickets,…. A patch is available.

How to fix or mitigate CVE-2026-48235?

Within 24 hours: Inventory all Open ISES Tickets deployments and verify which are running versions before 3.44.2; isolate or restrict network access if assessment cannot be completed immediately. Within 7 days: Upgrade all affected instances to v3.44.2. Within 30 days: Audit database logs and access records from the vulnerability disclosure date forward; perform integrity check on ticket and tracking data.

Open ISES Tickets CVE-2026-48235

Q: What is the CVSS score of CVE-2026-48235?

CVE-2026-48235 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31315 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-3r6v-wcmw-ghxc

PHP Google SQLi

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:34 vuln.today

Analysis Generated

May 21, 2026 - 18:34 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

8.2 (HIGH) 8.8 (HIGH)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitude integration) are concatenated into UPDATE and INSERT statements without sanitization. An attacker able to compromise or impersonate the remote GPS tracker endpoint can inject SQL to manipulate the responder location, tracks, and assignment tables.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 allows attackers controlling or impersonating an InstaMapper or Google Latitude GPS tracking endpoint to inject malicious SQL via unsanitized latitude, longitude, callsign, mph, altitude, and timestamp values parsed by incs/remotes.inc.php. The CVSS 4.0 base score of 8.8 reflects unauthenticated network exploitation with high confidentiality impact, and no public exploit is identified at time of analysis. The flaw was disclosed by VulnCheck and is one of 19 SQL injection issues patched in the v3.44.2 release.

Technical ContextAI

Open ISES Tickets is a PHP-based emergency responder dispatch and tracking application (CPE cpe:2.3:a:open_ises:tickets) that integrates with external GPS tracking services - specifically InstaMapper and Google Latitude - to populate responder location data. The vulnerable code path in incs/remotes.inc.php parses XML/JSON responses from these remote endpoints and concatenates field values directly into UPDATE and INSERT statements targeting the location, tracks, and assignment tables, which is a textbook CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) failure. The root cause is the implicit trust placed in third-party tracker payloads combined with absent parameterization or input sanitization in the database layer.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets 3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2 (Docker users run docker compose pull && docker compose up -d; traditional installs extract the zip over the existing deployment and run the installer in Upgrade mode). If immediate patching is not possible, disable the InstaMapper and Google Latitude integration features in the application configuration so incs/remotes.inc.php no longer fetches and parses external tracker payloads - note this disables automated responder GPS updates and requires manual location entry. As an additional compensating control, restrict the application server's outbound HTTP/HTTPS egress to only the original InstaMapper and Google Latitude hostnames (both services are defunct, so blocking outbound to the tracker endpoints entirely will prevent the vulnerable parsing path from being reached) and place the application behind a WAF tuned for SQL injection patterns in the latitude/longitude/callsign/mph/altitude/timestamp fields. Review the location, tracks, and assignment tables for evidence of tampering after applying the patch.