Which versions of Open ISES Tickets are affected by CVE-2026-48236?

Open ISES Tickets versions prior to 3.44.2 contain a SQL injection vulnerability accessible to authenticated users that could allow unauthorized database access or modification.. A patch is available.

How to fix or mitigate CVE-2026-48236?

Within 24 hours: Identify all Open ISES Tickets installations and document their current versions. Within 7 days: Upgrade all affected instances to v3.44.2 or later. Within 30 days: Review application logs and database audit trails for suspicious query patterns or unauthorized access attempts during the vulnerability exposure period.

Open ISES Tickets CVE-2026-48236

Q: What is the CVSS score of CVE-2026-48236?

CVE-2026-48236 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31318 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-4837-8524-277g

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:34 vuln.today

Analysis Generated

May 21, 2026 - 18:34 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating against an attacker-controlled database without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via unsanitized POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) in db_loader.php, enabling read, modification, or destruction of database contents. The vendor confirms this is one of 19 SQL injection flaws patched in v3.44.2, reported by VulnCheck. No public exploit identified at time of analysis, and the vulnerability requires low-privilege authentication (PR:L per CVSS 4.0 vector).

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/mapping application that uses MySQLi for database connectivity. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), where db_loader.php concatenates user-controlled POST parameters directly into mysqli connection arguments and dynamic SQL statements without parameterization or input sanitization. Per the CPE string cpe:2.3:a:open_ises:tickets:*, all versions of the tickets product prior to 3.44.2 are affected, and the v3.44.2 release notes confirm a sweeping security overhaul addressing 19 SQLi flaws across 11 files alongside 69 XSS issues, hardcoded secret removal, and SSL validation fixes.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets version 3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2, which addresses this and 87 other security issues; the specific fix commit is https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Docker deployments can upgrade with 'docker compose pull && docker compose up -d', while traditional installs should extract the new zip over the existing install and run the installer in Upgrade mode. If immediate patching is not possible, restrict access to db_loader.php at the web server or WAF layer (e.g., deny POST requests to /db_loader.php from untrusted networks) and tighten authentication to limit which users can reach the database loader endpoint - note that blocking db_loader.php may break legitimate database configuration workflows and require admin involvement to reconfigure.