CVE-2026-48235
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Open ISES Tickets before version 3.44.2 has a SQL injection vulnerability in incs/remotes.inc.php. Values like latitude, longitude, callsign, mph, altitude, and timestamp from external GPS services are concatenated into UPDATE and INSERT statements without sanitization.
Risk Assessment
An attacker who compromises or impersonates the GPS endpoint can inject SQL to manipulate responder location, tracks, and assignment tables, potentially disrupting operations.
Recommendation
Update Open ISES Tickets to version 3.44.2 or later, which fixes the SQL injection vulnerability.
Other vulnerabilities in Open ISES Tickets
See all- CVE-2026-48897High
Insufficient state checks allow bypassing two-factor authentication (2FA) controls.
- CVE-2026-48249Medium
Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.
- CVE-2026-48248Medium
Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false. An attacker on the network path can present a forged certificate to intercept authentication data.
- CVE-2026-48247Medium
Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing general-purpose outbound HTTPS requests via shared helper functions. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.
- CVE-2026-48246Medium
Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.
- CVE-2026-48245Medium
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.
- CVE-2026-48244Medium
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.
- CVE-2026-48243Medium
Open ISES Tickets before version 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.
- CVE-2026-48242High
In Open ISES Tickets before 3.44.2, hardcoded MySQL database credentials (host, username, password, database name) are present in import_mdb.php. These credentials are publicly available in the source repository.
- CVE-2026-48241High
Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.
Original NVD description (English source)
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitude integration) are concatenated into UPDATE and INSERT statements without sanitization. An attacker able to compromise or impersonate the remote GPS tracker endpoint can inject SQL to manipulate the responder location, tracks, and assignment tables.