Vulnerability details

CVE-2026-48236

Open ISES Tickets

Open ISES Tickets < 3.44.2 SQL Injection via db_loader.php Multiple Parameters

CVSS 4.0

7.1High

Official description

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating against an attacker-controlled database without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

CVSS scores

Score	Version	Source	Vector
7.1High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N`
7.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N`

Affected products

Vendor	Product	Versions	Source
Open ISES	Tickets	v < 3.44.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/openises/tickets/releases/tag/v3.44.2 release-notes
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff patch
https://www.vulncheck.com/advisories/open-ises-tickets-sql-injection-via-db-loader-php-multiple-parameters third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-05-21
Last updated: 2026-11-08
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.21%

Probability of exploitation in 30 days

11.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')