Which versions of Open ISES Tickets are affected by EUVD-2026-31311?

Open ISES Tickets versions prior to 3.44.2 contain a SQL injection vulnerability that allows authenticated users to directly manipulate database contents through unsanitized parameters in the…. A patch is available.

How to fix or mitigate EUVD-2026-31311?

Within 24 hours: inventory all Open ISES Tickets deployments and confirm current version. Within 7 days: upgrade all instances to version 3.44.2 or later. Within 30 days: review audit logs for suspicious database operations in the tables.php module and verify no unauthorized data changes occurred post-deployment.

Open ISES Tickets EUVD-2026-31311

Q: What is the CVSS score of EUVD-2026-31311?

EUVD-2026-31311 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-48231 HIGH

SQL Injection (CWE-89)

2026-05-21 VulnCheck

GHSA-jh65-7v5m-mh3v

PHP SQLi

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:32 vuln.today

Analysis Generated

May 21, 2026 - 18:32 vuln.today

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

AnalysisAI

SQL injection in Open ISES Tickets prior to 3.44.2 lets authenticated users tamper with database contents by abusing unsanitized POST parameters (tablename, indexname, sortby) in tables.php that are concatenated directly into SELECT, UPDATE, and DELETE identifier positions. The flaw is one of 19 SQLi issues fixed in the v3.44.2 release; no public exploit identified at time of analysis, but the vendor labels the release a Critical Security Update and urges immediate upgrade.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/incident-tracking web application (CPE cpe:2.3:a:open_ises:tickets) historically supporting PHP 7.0 through 8.4 with MariaDB/MySQL backends. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), and the specific variant is particularly difficult to mitigate: the tainted POST values are used as table and column identifiers rather than as data values, so parameterized queries alone do not help - the fix requires identifier allow-listing or strict whitelist validation, which is what v3.44.2 introduces across the affected tables.php and ten other files.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets v3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2 with the source fix in commit ecfeb406a016766cae81c749e14b5145a9f2dbff; Docker users can run 'docker compose pull && docker compose up -d' and traditional installs should extract the zip over the existing tree and run the installer in Upgrade mode. If patching must be deferred, restrict access to tables.php via a web-server rule (e.g., an Apache/Nginx location block requiring administrator IPs) - note this breaks legitimate admin table management; alternatively place the application behind a WAF with rules blocking suspicious SQL metacharacters in the tablename, indexname, and sortby POST parameters, accepting the usual WAF false-positive risk; and rotate database credentials and any of the 5 hardcoded secrets removed in 3.44.2 since long-lived installs may have leaked them.