Vulnerability · Published May 21, 2026 · Assigned by VulnCheck

CVE-2026-48231Open ISES Tickets < 3.44.2 SQL Injection via tables.php Multiple Parameters

High 7.1

In plain English

A high-severity SQL injection in Tickets from Open ISES. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Affected products (as reported)

Vendor	Product	Versions
Open ISES	Tickets	0 – before 3.44.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/openises/tickets/releases/tag/v3.44.2 release-notes
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff patch
https://www.vulncheck.com/advisories/open-ises-tickets-sql-injection-via-tables-php-multiple-parameters third-party-advisory