CVE-2026-48239
Last modified
CVE-2026-48239 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query semantics to read, modify, or destroy database contents.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48239?
How severe is CVE-2026-48239?
How do I fix CVE-2026-48239?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48233Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-48234Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-48235Open ISES Tickets before 3.44.2 contains a SQL injection vul…8.8
- CVE-2026-48236Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-48237Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-48238Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-4824A vulnerability has been found in Enter Software Iperius Bac…7
- CVE-2026-48240Open ISES Tickets before 3.44.2 contains a SQL injection vul…7.1
- CVE-2026-48241Open ISES Tickets before 3.44.2 contains hardcoded MySQL dat…9.2
- CVE-2026-48242Open ISES Tickets before 3.44.2 contains hardcoded MySQL dat…9.2
- CVE-2026-48243Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePage…6.9
- CVE-2026-48244Open ISES Tickets before 3.44.2 embeds a hardcoded Google Ma…6.9
Are you affected by CVE-2026-48239?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST