Dashboard / CVE-2026-48240

CVE-2026-48240

HIGH
MEDIUM Priority: 0.02 BB Relevance: 64/100
Published: 2026-05-21 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Open ISES Tickets 0 < 3.44.2

References & Advisories (3)

Bug Bounty Relevance

64 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

7.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.22%
Raw Score 0.002180
Percentile 12.4%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links