Dashboard / CVE-2026-48239

CVE-2026-48239

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-05-21 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Open ISES Tickets 0 < 3.44.2

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.21%
Raw Score 0.002140
Percentile 11.8%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links