Which versions of Open ISES Tickets are affected by CVE-2026-48240?

Open ISES Tickets versions before 3.44.2 contain a SQL injection vulnerability allowing authenticated users to access or modify sensitive database content; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-48240?

Within 24 hours: Identify all systems running Open ISES Tickets and determine current version. Within 7 days: Deploy patch to version 3.44.2 or later across all affected instances. Within 30 days: Review database access logs for suspicious activity during the exposure window and confirm patch deployment completion across all deployments.

Open ISES Tickets CVE-2026-48240

Q: What is the CVSS score of CVE-2026-48240?

CVE-2026-48240 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31322 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-64mc-q5rh-6vmq

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:32 vuln.today

Analysis Generated

May 21, 2026 - 18:32 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with backend database queries through the ajax/statistics.php endpoint by injecting payloads into the tick_id and f_tick_id POST parameters. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with lower integrity impact, and while no public exploit is identified at time of analysis, this flaw is one of 19 SQL injection issues bundled into a single critical security release that the vendor urges all users to install immediately.

Technical ContextAI

Open ISES Tickets is a PHP-based incident ticketing application used in emergency services/dispatch contexts, backed by MariaDB or MySQL. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) flaw where user-supplied POST parameters tick_id and f_tick_id are string-concatenated into the WHERE clause of SELECT statements that drive statistics rollup queries - bypassing prepared statements or input sanitization entirely. The CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* indicates the entire pre-3.44.2 product line is in scope, and the upstream commit ecfeb40 plus the v3.44.2 release tag contain the fix.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2, the vendor-released patched version which addresses this and 87 other vulnerabilities - Docker deployments can run 'docker compose pull && docker compose up -d' while traditional installs should extract the new zip over the existing installation and run the installer in Upgrade mode per the release notes at https://github.com/openises/tickets/releases/tag/v3.44.2. If immediate upgrade is not possible, restrict network access to ajax/statistics.php at the reverse proxy or web server level (this will break the statistics dashboard for end users), tighten the database account used by the application to read-only on tables that do not need modification to limit the modify/destroy impact, and audit application logs for unusual tick_id or f_tick_id POST values containing SQL metacharacters such as quotes, UNION, or comment sequences.