Open Ises
Monthly
Missing TLS certificate verification in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept and tamper with outbound HTTPS traffic from the mobile (RouteMate) login flow, exposing API keys and session-bearing data. The flaw stems from rm/incs/mobile_login.inc.php disabling CURLOPT_SSL_VERIFYPEER and omitting CURLOPT_SSL_VERIFYHOST. No public exploit identified at time of analysis, and the issue is one of 88 security fixes shipped in the v3.44.2 release.
Man-in-the-middle interception of authentication traffic in Open ISES Tickets before 3.44.2 is possible because the application's login flow in incs/login.inc.php disables TLS certificate verification on outbound HTTPS requests. Network-positioned attackers can present forged certificates to capture or modify API keys and session-bearing data exchanged during login. No public exploit identified at time of analysis, though the fix is bundled into a broader critical security release that also addresses 69 XSS and 19 SQL injection issues.
Man-in-the-middle exposure in Open ISES Tickets before 3.44.2 stems from the shared helper functions in incs/functions.inc.php disabling TLS certificate verification (CURLOPT_SSL_VERIFYPEER=false) on outbound HTTPS calls, letting network-positioned attackers intercept or modify traffic carrying API keys and session data. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the vendor's v3.44.2 release notes describe it as a critical security update that also bundles fixes for 88 other issues including XSS and SQL injection.
TLS certificate verification bypass in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept HTTPS traffic between the application server and Google Maps Directions API during incident report generation. The flaw stems from ajax/reports.php explicitly setting CURLOPT_SSL_VERIFYPEER to false without configuring CURLOPT_SSL_VERIFYHOST, exposing Google API keys and any session-bearing data carried in outbound requests. No public exploit identified at time of analysis, and SSVC reports no observed exploitation, but a vendor patch is available in v3.44.2.
Credential exposure in Open ISES Tickets versions prior to 3.44.2 allows remote attackers to obtain valid MySQL database connection parameters (host, username, password, database name) hardcoded in import_mdb.php and committed to the public source repository. Any attacker who can read the public GitHub source can extract these credentials and attempt to authenticate against deployed installations that retained the default values, with no public exploit identified at time of analysis.
Hardcoded MySQL credentials in Open ISES Tickets before 3.44.2 expose database username, password, and database name through a public-facing loader.php utility that was committed to the source repository. Any user able to read the source tree on GitHub or fetch the file from a deployed installation can connect to the backing database if reachable, leading to full read/write access. No public exploit identified at time of analysis, but the credentials are trivially recoverable from the source tree.
SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with backend database queries through the ajax/statistics.php endpoint by injecting payloads into the tick_id and f_tick_id POST parameters. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with lower integrity impact, and while no public exploit is identified at time of analysis, this flaw is one of 19 SQL injection issues bundled into a single critical security release that the vendor urges all users to install immediately.
SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with the incidents summary report query via the tick_id POST parameter in ajax/reports.php, enabling arbitrary read, modification, or destruction of database contents. The v3.44.2 release notes confirm the fix was part of a broader security overhaul addressing 19 SQL injection flaws and 69 XSS issues. No public exploit identified at time of analysis, and SSVC classifies exploitation status as 'none' with partial technical impact.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized `id` GET parameter in `ajax/mobile_main.php`. The flaw permits arbitrary read, modification, or destruction of database contents, and is part of a broader batch of 19 SQL injection fixes shipped in v3.44.2. No public exploit identified at time of analysis, but the vendor explicitly classifies v3.44.2 as a 'Critical Security Update' urging immediate upgrade.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate backend database queries via the message.php endpoint, enabling unauthorized read, modification, or destruction of database contents. The flaw stems from unsanitized concatenation of the frm_ticket_id and frm_resp_id POST parameters into SELECT and UPDATE statements. No public exploit identified at time of analysis, though VulnCheck has published a dedicated advisory and the vendor's 3.44.2 release bundles fixes for 19 SQL injection issues across the codebase.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via unsanitized POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) in db_loader.php, enabling read, modification, or destruction of database contents. The vendor confirms this is one of 19 SQL injection flaws patched in v3.44.2, reported by VulnCheck. No public exploit identified at time of analysis, and the vulnerability requires low-privilege authentication (PR:L per CVSS 4.0 vector).
SQL injection in Open ISES Tickets before 3.44.2 allows attackers controlling or impersonating an InstaMapper or Google Latitude GPS tracking endpoint to inject malicious SQL via unsanitized latitude, longitude, callsign, mph, altitude, and timestamp values parsed by incs/remotes.inc.php. The CVSS 4.0 base score of 8.8 reflects unauthenticated network exploitation with high confidentiality impact, and no public exploit is identified at time of analysis. The flaw was disclosed by VulnCheck and is one of 19 SQL injection issues patched in the v3.44.2 release.
SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate ORDER BY clauses via the sort and dir GET parameters in portal/ajax/list_requests.php, enabling unauthorized read, modification, or destruction of database contents. The CVSS 4.0 score of 7.1 reflects network-reachable exploitation with low privileges and no user interaction required. No public exploit identified at time of analysis, but the vendor's own release notes describe this as part of a critical security update patching 19 SQL injection flaws across 11 files.
SQL injection in Open ISES Tickets prior to 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized 'offset' GET parameter in ajax/sit_incidents.php, which is concatenated directly into a LIMIT clause. Successful exploitation enables reading, modifying, or destroying database contents. No public exploit identified at time of analysis, though the underlying flaw is one of 19 SQL injection issues patched in the same release, indicating broad code-level weakness.
SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate database queries through the unsanitized offset parameter in ajax/fullsit_incidents.php. The flaw enables reading, modifying, or destroying database contents and is part of a broader v3.44.2 security release that patched 19 SQL injection issues. No public exploit identified at time of analysis, but the vendor classifies the update as critical and urges immediate upgrade.
SQL injection in Open ISES Tickets prior to 3.44.2 lets authenticated users tamper with database contents by abusing unsanitized POST parameters (tablename, indexname, sortby) in tables.php that are concatenated directly into SELECT, UPDATE, and DELETE identifier positions. The flaw is one of 19 SQLi issues fixed in the v3.44.2 release; no public exploit identified at time of analysis, but the vendor labels the release a Critical Security Update and urges immediate upgrade.
Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in tables.php, affecting all versions before 3.44.2. Any party with read access to the repository - effectively the entire internet - can extract the key and authenticate to Google Maps Platform as the application owner, generating API usage billed against the victim's Google Cloud project. No public exploit has been identified at time of analysis, but the SSVC framework rates this as automatable with partial technical impact, and the v3.44.2 release notes confirm the key is one of five hardcoded secrets removed in a batch of 88 security fixes.
Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the public GitHub repository to extract a valid API credential from settings.inc.php and issue arbitrary Google Maps Platform requests billed against the victim organization's Google Cloud project. All versions from the initial release up to (but not including) 3.44.2 are affected per CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but exploitation requires only the ability to read a publicly hosted source file - effectively zero technical barrier for any motivated actor.
Open ISES Tickets before v3.44.2 exposes a hardcoded WhitePages reverse-phone API key committed directly into the public source file wp1.php, making it trivially accessible to any actor who can read the repository. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects that no authentication or special conditions are required - extraction is as simple as reading a publicly hosted source file. Impact is bounded to third-party API abuse: an attacker can use the stolen key to make WhitePages lookups billed to or rate-capped against the legitimate owner's account. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV, though the passive nature of the exposure means any observer of the repository may already possess the key.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows JavaScript injection via ten unsanitized POST parameters in ticketsmdb_import.php, with payloads executing in the victim's browser upon response rendering. The vendor-released patch v3.44.2 addresses this as part of a critical security update that simultaneously fixed 88 vulnerabilities including 69 XSS and 19 SQL injection issues across the codebase, suggesting systemic input sanitization failures rather than an isolated defect. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript via the unsanitized ticket_id GET parameter in routes_i.php, rendered directly into HTML form hidden input value attributes. When a victim visits or is redirected to a crafted URL, the payload executes in their browser within the application's security context. No public exploit or CISA KEV listing exists at time of analysis, but the patch release (v3.44.2) simultaneously fixes 88 vulnerabilities - 69 of them XSS - indicating systemic input sanitization failures throughout the codebase that substantially elevate the overall risk posture of this application.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows attackers to inject arbitrary JavaScript through unsanitized id and ticket_id GET parameters in patient_w.php, which are written directly into an HTML form action URL without output encoding. Successful exploitation requires the victim to actively click a crafted link, after which the payload executes in the victim's browser under the application's origin, enabling session hijacking or unauthorized actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the scale of the v3.44.2 release - patching 69 XSS and 19 SQL injection issues simultaneously - suggests the codebase has historically received minimal security review.
Reflected XSS in Open ISES Tickets before 3.44.2 exposes authenticated users to arbitrary JavaScript execution via unsanitized GET parameters in patient.php. The vulnerability exists in the id and ticket_id parameters, whose values are written directly into an HTML form action URL without output encoding, enabling an attacker to craft a malicious link that executes script in the victim's browser upon rendering. No public exploit or active exploitation has been identified at time of analysis; however, the vendor's v3.44.2 release confirms this is one of 69 XSS vulnerabilities patched simultaneously, indicating systemic input-handling failures across the application.
Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows JavaScript injection via the unsanitized `ref` and `mode_orig` POST parameters in `os_watch.php`, which are written verbatim into HTML form hidden input value attributes without output encoding. An attacker who can trick a user into submitting a crafted POST request will have arbitrary JavaScript execute in that user's browser session, enabling session theft, credential harvesting, or UI redress attacks. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the patch release simultaneously addressed 88 vulnerabilities - including 19 SQL injection issues - suggesting this application carried significant accumulated security debt that amplifies organizational risk beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows an attacker to inject arbitrary JavaScript via the unsanitized _type POST parameter in landb.php, which is echoed directly into an HTML form hidden input value attribute without encoding. When a victim renders the crafted response, the injected script executes in their browser context, enabling session hijacking, credential theft, or forced action on behalf of the victim. This CVE is one of 69 XSS vulnerabilities addressed in the v3.44.2 critical security update; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics214.php, which reflects the unsanitized value directly into an HTML form hidden input value attribute. When a victim renders the crafted response, the payload executes in their browser session, enabling session hijacking or action-on-behalf-of-user attacks. No public exploit has been identified and this CVE is not listed in CISA KEV, though the v3.44.2 release addresses 88 total vulnerabilities - including SQL injection and hardcoded credentials - making upgrade broadly critical regardless of this specific finding.
Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows a malicious actor to inject arbitrary JavaScript into a victim's browser session via the unsanitized frm_add_str POST parameter in ics213rr.php, where the value is written directly into an HTML form hidden input attribute without escaping. The CVSS 4.0 vector scores this at 5.1 with scope change to subsequent systems (SC:L/SI:L), meaning successful exploitation affects data beyond the immediately vulnerable component. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch (v3.44.2) is confirmed available and also resolves 87 additional vulnerabilities including SQL injection, hardcoded credentials, and SSL validation failures.
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics213.php, which is rendered unsanitized inside an HTML hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no privileges are required on the attacker side, but victim interaction is mandatory - a user must submit or be tricked into triggering the crafted request. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 critical security release, signaling systemic input sanitization failures across the codebase. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows injection of arbitrary JavaScript via the unsanitized frm_add_str POST parameter in ics205a.php, which is rendered verbatim inside an HTML form hidden input value attribute in the victim's browser. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release - a 'Critical Security Update' that also addressed 19 SQL injection issues and 5 hardcoded secrets, revealing systemic input handling failures across the codebase. No public exploit identified at time of analysis and no CISA KEV listing; however, the broader security debt in this application makes upgrading urgent beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics205.php, which is rendered unsanitized inside an HTML form hidden input value attribute. The attacker must induce an authenticated victim to submit a crafted request (UI:A), limiting opportunistic exploitation but enabling session hijacking, credential theft, or further browser-based attacks against logged-in users. This CVE is one of 69 XSS vulnerabilities patched in v3.44.2, which also addressed 19 SQL injection issues and hardcoded credentials - indicating systemic input-handling deficiencies across the PHP codebase. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics202.php, where the unsanitized value is written directly into an HTML form hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no attacker privilege is required, but victim interaction is mandatory - meaning an attacker must deceive a user into submitting a crafted POST request to trigger execution. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release alongside 19 SQL injection flaws and 5 hardcoded secrets, signaling a systemic insecurity posture in the codebase prior to this release. No public exploit identified at time of analysis; no CISA KEV listing.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) exposes the icons/buttons/landb.php endpoint to arbitrary JavaScript injection via unsanitized frm_name and frm_id POST parameters, which are rendered directly into both HTML content and inline JavaScript without encoding or sanitization. An attacker who can socially engineer an authenticated user into triggering a crafted POST request can execute arbitrary JavaScript within that user's browser session, enabling session hijacking, credential theft, or malicious UI manipulation. No public exploit has been identified at time of analysis; a vendor-released patch (v3.44.2) is available and all users are urged to upgrade immediately per the vendor's own release advisory.
Reflected XSS in Open ISES Tickets before 3.44.2 allows JavaScript injection via unsanitized POST parameters (module_choice, flag, confirmation) in delete_module.php, executing attacker-supplied code in the browser of a victim who interacts with a crafted request. The CVSS 4.0 vector (PR:N/UI:A) indicates the attacker requires no privileges but depends on active victim interaction - consistent with a POST-based reflected XSS delivered via a cross-site auto-submitting form targeting an authenticated session. No public exploit has been identified at time of analysis, and vendor-released patch v3.44.2 is available, a landmark release that simultaneously addressed 88 vulnerabilities including 19 SQL injections and 68 additional XSS issues across the same codebase.
Reflected XSS in Open ISES Tickets before v3.44.2 allows JavaScript injection via six unsanitized POST parameters in db_loader.php (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema), each reflected verbatim into HTML form input value attributes. An attacker who can deliver a crafted POST request to a victim's browser can execute arbitrary JavaScript in the victim's session context, enabling session hijacking or credential theft. The vendor-confirmed fix (v3.44.2) was released as a critical security update resolving 88 total vulnerabilities; no public exploit or CISA KEV listing is identified at time of analysis.
Reflected XSS in Open ISES Tickets (versions before 3.44.2) allows network-based attackers to inject arbitrary JavaScript through the frm_id POST parameter in circle.php, requiring victim interaction with a crafted link or form. The vulnerability executes malicious scripts in the victim's browser context with low-scope impact to confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis. VulnCheck reported this as one of 69 XSS vulnerabilities patched in the v3.44.2 security release, which addressed 88 total security issues including SQL injection and hardcoded credentials.
Reflected XSS in Open ISES Tickets before v3.44.2 enables JavaScript injection through the unsanitized ticket_id POST parameter in add_nm.php, which is embedded without encoding into both an HTML form input value attribute and an inline JavaScript string literal - two distinct injection contexts. When a victim renders the malicious response, attacker-controlled script executes in their browser with potential to steal session tokens or perform actions under their identity. No public exploit exists and the vulnerability is not in CISA KEV, but the v3.44.2 release notes reveal 88 co-patched security defects (including 19 SQL injection issues and hardcoded secrets), meaning any unpatched deployment faces compounded, systemic risk far beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows injection of arbitrary JavaScript via the ticket_id POST parameter in add.php, which is echoed unsanitized into an HTML form input value attribute. The CVSS 4.0 vector scores this at 5.1 with no privileges required and active user interaction needed, though the CVE description characterizes attackers as authenticated - a discrepancy discussed in the risk section. No public exploit code or CISA KEV listing exists at time of analysis. This vulnerability is one of 69 XSS issues patched in a single v3.44.2 release that also addressed 19 SQL injection flaws and 5 hardcoded secrets, suggesting systemic insecure coding practices across the codebase.
Missing TLS certificate verification in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept and tamper with outbound HTTPS traffic from the mobile (RouteMate) login flow, exposing API keys and session-bearing data. The flaw stems from rm/incs/mobile_login.inc.php disabling CURLOPT_SSL_VERIFYPEER and omitting CURLOPT_SSL_VERIFYHOST. No public exploit identified at time of analysis, and the issue is one of 88 security fixes shipped in the v3.44.2 release.
Man-in-the-middle interception of authentication traffic in Open ISES Tickets before 3.44.2 is possible because the application's login flow in incs/login.inc.php disables TLS certificate verification on outbound HTTPS requests. Network-positioned attackers can present forged certificates to capture or modify API keys and session-bearing data exchanged during login. No public exploit identified at time of analysis, though the fix is bundled into a broader critical security release that also addresses 69 XSS and 19 SQL injection issues.
Man-in-the-middle exposure in Open ISES Tickets before 3.44.2 stems from the shared helper functions in incs/functions.inc.php disabling TLS certificate verification (CURLOPT_SSL_VERIFYPEER=false) on outbound HTTPS calls, letting network-positioned attackers intercept or modify traffic carrying API keys and session data. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the vendor's v3.44.2 release notes describe it as a critical security update that also bundles fixes for 88 other issues including XSS and SQL injection.
TLS certificate verification bypass in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept HTTPS traffic between the application server and Google Maps Directions API during incident report generation. The flaw stems from ajax/reports.php explicitly setting CURLOPT_SSL_VERIFYPEER to false without configuring CURLOPT_SSL_VERIFYHOST, exposing Google API keys and any session-bearing data carried in outbound requests. No public exploit identified at time of analysis, and SSVC reports no observed exploitation, but a vendor patch is available in v3.44.2.
Credential exposure in Open ISES Tickets versions prior to 3.44.2 allows remote attackers to obtain valid MySQL database connection parameters (host, username, password, database name) hardcoded in import_mdb.php and committed to the public source repository. Any attacker who can read the public GitHub source can extract these credentials and attempt to authenticate against deployed installations that retained the default values, with no public exploit identified at time of analysis.
Hardcoded MySQL credentials in Open ISES Tickets before 3.44.2 expose database username, password, and database name through a public-facing loader.php utility that was committed to the source repository. Any user able to read the source tree on GitHub or fetch the file from a deployed installation can connect to the backing database if reachable, leading to full read/write access. No public exploit identified at time of analysis, but the credentials are trivially recoverable from the source tree.
SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with backend database queries through the ajax/statistics.php endpoint by injecting payloads into the tick_id and f_tick_id POST parameters. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with lower integrity impact, and while no public exploit is identified at time of analysis, this flaw is one of 19 SQL injection issues bundled into a single critical security release that the vendor urges all users to install immediately.
SQL injection in Open ISES Tickets before 3.44.2 lets authenticated users tamper with the incidents summary report query via the tick_id POST parameter in ajax/reports.php, enabling arbitrary read, modification, or destruction of database contents. The v3.44.2 release notes confirm the fix was part of a broader security overhaul addressing 19 SQL injection flaws and 69 XSS issues. No public exploit identified at time of analysis, and SSVC classifies exploitation status as 'none' with partial technical impact.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized `id` GET parameter in `ajax/mobile_main.php`. The flaw permits arbitrary read, modification, or destruction of database contents, and is part of a broader batch of 19 SQL injection fixes shipped in v3.44.2. No public exploit identified at time of analysis, but the vendor explicitly classifies v3.44.2 as a 'Critical Security Update' urging immediate upgrade.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate backend database queries via the message.php endpoint, enabling unauthorized read, modification, or destruction of database contents. The flaw stems from unsanitized concatenation of the frm_ticket_id and frm_resp_id POST parameters into SELECT and UPDATE statements. No public exploit identified at time of analysis, though VulnCheck has published a dedicated advisory and the vendor's 3.44.2 release bundles fixes for 19 SQL injection issues across the codebase.
SQL injection in Open ISES Tickets before 3.44.2 allows authenticated attackers to manipulate database queries via unsanitized POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) in db_loader.php, enabling read, modification, or destruction of database contents. The vendor confirms this is one of 19 SQL injection flaws patched in v3.44.2, reported by VulnCheck. No public exploit identified at time of analysis, and the vulnerability requires low-privilege authentication (PR:L per CVSS 4.0 vector).
SQL injection in Open ISES Tickets before 3.44.2 allows attackers controlling or impersonating an InstaMapper or Google Latitude GPS tracking endpoint to inject malicious SQL via unsanitized latitude, longitude, callsign, mph, altitude, and timestamp values parsed by incs/remotes.inc.php. The CVSS 4.0 base score of 8.8 reflects unauthenticated network exploitation with high confidentiality impact, and no public exploit is identified at time of analysis. The flaw was disclosed by VulnCheck and is one of 19 SQL injection issues patched in the v3.44.2 release.
SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate ORDER BY clauses via the sort and dir GET parameters in portal/ajax/list_requests.php, enabling unauthorized read, modification, or destruction of database contents. The CVSS 4.0 score of 7.1 reflects network-reachable exploitation with low privileges and no user interaction required. No public exploit identified at time of analysis, but the vendor's own release notes describe this as part of a critical security update patching 19 SQL injection flaws across 11 files.
SQL injection in Open ISES Tickets prior to 3.44.2 allows authenticated attackers to manipulate database queries via the unsanitized 'offset' GET parameter in ajax/sit_incidents.php, which is concatenated directly into a LIMIT clause. Successful exploitation enables reading, modifying, or destroying database contents. No public exploit identified at time of analysis, though the underlying flaw is one of 19 SQL injection issues patched in the same release, indicating broad code-level weakness.
SQL injection in Open ISES Tickets versions prior to 3.44.2 allows authenticated attackers to manipulate database queries through the unsanitized offset parameter in ajax/fullsit_incidents.php. The flaw enables reading, modifying, or destroying database contents and is part of a broader v3.44.2 security release that patched 19 SQL injection issues. No public exploit identified at time of analysis, but the vendor classifies the update as critical and urges immediate upgrade.
SQL injection in Open ISES Tickets prior to 3.44.2 lets authenticated users tamper with database contents by abusing unsanitized POST parameters (tablename, indexname, sortby) in tables.php that are concatenated directly into SELECT, UPDATE, and DELETE identifier positions. The flaw is one of 19 SQLi issues fixed in the v3.44.2 release; no public exploit identified at time of analysis, but the vendor labels the release a Critical Security Update and urges immediate upgrade.
Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in tables.php, affecting all versions before 3.44.2. Any party with read access to the repository - effectively the entire internet - can extract the key and authenticate to Google Maps Platform as the application owner, generating API usage billed against the victim's Google Cloud project. No public exploit has been identified at time of analysis, but the SSVC framework rates this as automatable with partial technical impact, and the v3.44.2 release notes confirm the key is one of five hardcoded secrets removed in a batch of 88 security fixes.
Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the public GitHub repository to extract a valid API credential from settings.inc.php and issue arbitrary Google Maps Platform requests billed against the victim organization's Google Cloud project. All versions from the initial release up to (but not including) 3.44.2 are affected per CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but exploitation requires only the ability to read a publicly hosted source file - effectively zero technical barrier for any motivated actor.
Open ISES Tickets before v3.44.2 exposes a hardcoded WhitePages reverse-phone API key committed directly into the public source file wp1.php, making it trivially accessible to any actor who can read the repository. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects that no authentication or special conditions are required - extraction is as simple as reading a publicly hosted source file. Impact is bounded to third-party API abuse: an attacker can use the stolen key to make WhitePages lookups billed to or rate-capped against the legitimate owner's account. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV, though the passive nature of the exposure means any observer of the repository may already possess the key.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows JavaScript injection via ten unsanitized POST parameters in ticketsmdb_import.php, with payloads executing in the victim's browser upon response rendering. The vendor-released patch v3.44.2 addresses this as part of a critical security update that simultaneously fixed 88 vulnerabilities including 69 XSS and 19 SQL injection issues across the codebase, suggesting systemic input sanitization failures rather than an isolated defect. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript via the unsanitized ticket_id GET parameter in routes_i.php, rendered directly into HTML form hidden input value attributes. When a victim visits or is redirected to a crafted URL, the payload executes in their browser within the application's security context. No public exploit or CISA KEV listing exists at time of analysis, but the patch release (v3.44.2) simultaneously fixes 88 vulnerabilities - 69 of them XSS - indicating systemic input sanitization failures throughout the codebase that substantially elevate the overall risk posture of this application.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows attackers to inject arbitrary JavaScript through unsanitized id and ticket_id GET parameters in patient_w.php, which are written directly into an HTML form action URL without output encoding. Successful exploitation requires the victim to actively click a crafted link, after which the payload executes in the victim's browser under the application's origin, enabling session hijacking or unauthorized actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the scale of the v3.44.2 release - patching 69 XSS and 19 SQL injection issues simultaneously - suggests the codebase has historically received minimal security review.
Reflected XSS in Open ISES Tickets before 3.44.2 exposes authenticated users to arbitrary JavaScript execution via unsanitized GET parameters in patient.php. The vulnerability exists in the id and ticket_id parameters, whose values are written directly into an HTML form action URL without output encoding, enabling an attacker to craft a malicious link that executes script in the victim's browser upon rendering. No public exploit or active exploitation has been identified at time of analysis; however, the vendor's v3.44.2 release confirms this is one of 69 XSS vulnerabilities patched simultaneously, indicating systemic input-handling failures across the application.
Reflected XSS in Open ISES Tickets (all versions before 3.44.2) allows JavaScript injection via the unsanitized `ref` and `mode_orig` POST parameters in `os_watch.php`, which are written verbatim into HTML form hidden input value attributes without output encoding. An attacker who can trick a user into submitting a crafted POST request will have arbitrary JavaScript execute in that user's browser session, enabling session theft, credential harvesting, or UI redress attacks. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the patch release simultaneously addressed 88 vulnerabilities - including 19 SQL injection issues - suggesting this application carried significant accumulated security debt that amplifies organizational risk beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows an attacker to inject arbitrary JavaScript via the unsanitized _type POST parameter in landb.php, which is echoed directly into an HTML form hidden input value attribute without encoding. When a victim renders the crafted response, the injected script executes in their browser context, enabling session hijacking, credential theft, or forced action on behalf of the victim. This CVE is one of 69 XSS vulnerabilities addressed in the v3.44.2 critical security update; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics214.php, which reflects the unsanitized value directly into an HTML form hidden input value attribute. When a victim renders the crafted response, the payload executes in their browser session, enabling session hijacking or action-on-behalf-of-user attacks. No public exploit has been identified and this CVE is not listed in CISA KEV, though the v3.44.2 release addresses 88 total vulnerabilities - including SQL injection and hardcoded credentials - making upgrade broadly critical regardless of this specific finding.
Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows a malicious actor to inject arbitrary JavaScript into a victim's browser session via the unsanitized frm_add_str POST parameter in ics213rr.php, where the value is written directly into an HTML form hidden input attribute without escaping. The CVSS 4.0 vector scores this at 5.1 with scope change to subsequent systems (SC:L/SI:L), meaning successful exploitation affects data beyond the immediately vulnerable component. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch (v3.44.2) is confirmed available and also resolves 87 additional vulnerabilities including SQL injection, hardcoded credentials, and SSL validation failures.
Reflected cross-site scripting in Open ISES Tickets before v3.44.2 allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics213.php, which is rendered unsanitized inside an HTML hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no privileges are required on the attacker side, but victim interaction is mandatory - a user must submit or be tricked into triggering the crafted request. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 critical security release, signaling systemic input sanitization failures across the codebase. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 allows injection of arbitrary JavaScript via the unsanitized frm_add_str POST parameter in ics205a.php, which is rendered verbatim inside an HTML form hidden input value attribute in the victim's browser. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release - a 'Critical Security Update' that also addressed 19 SQL injection issues and 5 hardcoded secrets, revealing systemic input handling failures across the codebase. No public exploit identified at time of analysis and no CISA KEV listing; however, the broader security debt in this application makes upgrading urgent beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) allows injection of arbitrary JavaScript through the frm_add_str POST parameter in ics205.php, which is rendered unsanitized inside an HTML form hidden input value attribute. The attacker must induce an authenticated victim to submit a crafted request (UI:A), limiting opportunistic exploitation but enabling session hijacking, credential theft, or further browser-based attacks against logged-in users. This CVE is one of 69 XSS vulnerabilities patched in v3.44.2, which also addressed 19 SQL injection issues and hardcoded credentials - indicating systemic input-handling deficiencies across the PHP codebase. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in Open ISES Tickets before version 3.44.2 enables JavaScript injection via the frm_add_str POST parameter in ics202.php, where the unsanitized value is written directly into an HTML form hidden input value attribute. The CVSS 4.0 vector (PR:N/UI:A) indicates no attacker privilege is required, but victim interaction is mandatory - meaning an attacker must deceive a user into submitting a crafted POST request to trigger execution. This CVE is one of 69 XSS vulnerabilities patched in the v3.44.2 release alongside 19 SQL injection flaws and 5 hardcoded secrets, signaling a systemic insecurity posture in the codebase prior to this release. No public exploit identified at time of analysis; no CISA KEV listing.
Reflected cross-site scripting in Open ISES Tickets (all versions before 3.44.2) exposes the icons/buttons/landb.php endpoint to arbitrary JavaScript injection via unsanitized frm_name and frm_id POST parameters, which are rendered directly into both HTML content and inline JavaScript without encoding or sanitization. An attacker who can socially engineer an authenticated user into triggering a crafted POST request can execute arbitrary JavaScript within that user's browser session, enabling session hijacking, credential theft, or malicious UI manipulation. No public exploit has been identified at time of analysis; a vendor-released patch (v3.44.2) is available and all users are urged to upgrade immediately per the vendor's own release advisory.
Reflected XSS in Open ISES Tickets before 3.44.2 allows JavaScript injection via unsanitized POST parameters (module_choice, flag, confirmation) in delete_module.php, executing attacker-supplied code in the browser of a victim who interacts with a crafted request. The CVSS 4.0 vector (PR:N/UI:A) indicates the attacker requires no privileges but depends on active victim interaction - consistent with a POST-based reflected XSS delivered via a cross-site auto-submitting form targeting an authenticated session. No public exploit has been identified at time of analysis, and vendor-released patch v3.44.2 is available, a landmark release that simultaneously addressed 88 vulnerabilities including 19 SQL injections and 68 additional XSS issues across the same codebase.
Reflected XSS in Open ISES Tickets before v3.44.2 allows JavaScript injection via six unsanitized POST parameters in db_loader.php (ticketshost, ticketsdb, ticketsuser, ticketspassword, ticketsprefix, db_schema), each reflected verbatim into HTML form input value attributes. An attacker who can deliver a crafted POST request to a victim's browser can execute arbitrary JavaScript in the victim's session context, enabling session hijacking or credential theft. The vendor-confirmed fix (v3.44.2) was released as a critical security update resolving 88 total vulnerabilities; no public exploit or CISA KEV listing is identified at time of analysis.
Reflected XSS in Open ISES Tickets (versions before 3.44.2) allows network-based attackers to inject arbitrary JavaScript through the frm_id POST parameter in circle.php, requiring victim interaction with a crafted link or form. The vulnerability executes malicious scripts in the victim's browser context with low-scope impact to confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis. VulnCheck reported this as one of 69 XSS vulnerabilities patched in the v3.44.2 security release, which addressed 88 total security issues including SQL injection and hardcoded credentials.
Reflected XSS in Open ISES Tickets before v3.44.2 enables JavaScript injection through the unsanitized ticket_id POST parameter in add_nm.php, which is embedded without encoding into both an HTML form input value attribute and an inline JavaScript string literal - two distinct injection contexts. When a victim renders the malicious response, attacker-controlled script executes in their browser with potential to steal session tokens or perform actions under their identity. No public exploit exists and the vulnerability is not in CISA KEV, but the v3.44.2 release notes reveal 88 co-patched security defects (including 19 SQL injection issues and hardcoded secrets), meaning any unpatched deployment faces compounded, systemic risk far beyond this single CVE.
Reflected cross-site scripting in Open ISES Tickets before 3.44.2 allows injection of arbitrary JavaScript via the ticket_id POST parameter in add.php, which is echoed unsanitized into an HTML form input value attribute. The CVSS 4.0 vector scores this at 5.1 with no privileges required and active user interaction needed, though the CVE description characterizes attackers as authenticated - a discrepancy discussed in the risk section. No public exploit code or CISA KEV listing exists at time of analysis. This vulnerability is one of 69 XSS issues patched in a single v3.44.2 release that also addressed 19 SQL injection flaws and 5 hardcoded secrets, suggesting systemic insecure coding practices across the codebase.