CVE Vulnerability Catalog

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/mobile_main.php. The GET parameter 'id' is concatenated into the WHERE clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in message.php. POST parameters 'frm_ticket_id' and 'frm_resp_id' are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in db_loader.php. POST parameters 'ticketsdb', 'ticketshost', 'ticketsuser', 'ticketspassword' are concatenated into mysqli connection arguments and dynamic SQL without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

Open ISES Tickets before version 3.44.2 has a SQL injection vulnerability in incs/remotes.inc.php. Values like latitude, longitude, callsign, mph, altitude, and timestamp from external GPS services are concatenated into UPDATE and INSERT statements without sanitization.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in portal/ajax/list_requests.php. GET parameters 'sort' and 'dir' are concatenated into the ORDER BY clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/sit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in ajax/fullsit_incidents.php. GET parameter 'offset' is concatenated into the LIMIT clause of a SELECT statement without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

SQL injection vulnerability in Open ISES Tickets before 3.44.2 exists in tables.php. POST parameters 'tablename', 'indexname', 'sortby' are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization, allowing authenticated attackers to read, modify, or destroy database contents.

The ConnectWise Automate Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.

A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. The attacker must first obtain the ability to execute low-privileged code.

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-45206 but in a different process protection communication mechanism. The attacker must first obtain the ability to execute low-privileged code.

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-45207 but in a different process protection communication mechanism. The attacker must first obtain the ability to execute low-privileged code.

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. Similar to CVE-2026-34927 but in a different process protection mechanism. The attacker must first obtain the ability to execute low-privileged code.

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. This is similar to CVE-2026-34927 but exists in a different inter-process communication mechanism. The attacker must first obtain the ability to execute low-privileged code.

An origin validation vulnerability in the Apex One/SEP agent allows a local attacker to escalate privileges via a named pipe communication mechanism. The attacker must first obtain low-privileged code execution.

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges. The attacker must first obtain the ability to execute low-privileged code.

Authenticated remote code execution vulnerability in Zohocorp ManageEngine products: ADSelfService Plus before 6525, DataSecurity Plus before 6264, and RecoveryManager Plus before 6313. Caused by a bug in a third-party dependency.

An origin validation error in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges. The attacker must first execute low-privileged code.

Time-of-check time-of-use vulnerability in Trend Micro Apex One (Mac) agent cache mechanism allows local attacker to escalate privileges. Requires prior low-privileged code execution. Patches available in ActiveUpdate/SaaS updates from mid/late 2025.

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent iCore service signature verification could allow a local attacker to escalate privileges. The attacker must first execute low-privileged code.