CVE-2026-48240

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2

Description An issue exists in the 'ajax/statistics.php' endpoint where the tick id and f tick id POST parameters are concatenated into WHERE clauses of SELECT statements in statistics rollup queries without proper sanitization. This allows authenticated attackers to manipulate query semantics to read, modify, or destroy database contents via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Update to version 3.44.2 or later. Avoid using the tick id and f tick id parameters in the 'ajax/statistics.php' endpoint until the update is applied.