CVE-2026-48233

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description An issue exists where the offset GET parameter in the 'ajax/sit incidents.php' endpoint is concatenated into the LIMIT clause of a SELECT statement without proper sanitization. This allows authenticated attackers to manipulate query semantics to read, modify, or destroy database contents. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, allowing unauthorized access to the database.

Recommendations Update to version 3.44.2 or later. As a temporary mitigation, restrict access to the 'ajax/sit incidents.php' endpoint or avoid using the offset parameter.