SQL Injection Vulnerability in Open ISES Tickets by Open ISES

CVE-2026-48235

What is CVE-2026-48235?

The Open ISES Tickets application prior to version 3.44.2 contains a SQL injection vulnerability found in the incs/remotes.inc.php file. This issue arises from the improper handling of user inputs parsed from external GPS tracking services, including latitude, longitude, callsign, mph, altitude, and timestamp data. An attacker leveraging access to a compromised or impersonated GPS tracking endpoint can inject malicious SQL queries into the application. This could lead to unauthorized manipulation of responder locations, track data, and assignment records, posing a significant risk to application integrity and the security of sensitive information.

References