Linux Distros Unpatched Vulnerability : CVE-2026-46638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Twig is a template language for PHP. Prior to 3.26.0, % sandbox %% include % can include a template that was previously loaded outside the sandbox without...

PT-2026-42515

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description An issue exists in the message.php file where the frm ticket id and frm resp id POST parameters are concatenated into WHERE clauses of SELECT and UPDATE statements without proper...

PT-2026-42480

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'add.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the ticket id POS...

CVE-2026-48222: Improper Neutralization of Input During Web Page Generation

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

PT-2026-42499

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'ics205a.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value via the frm add str...

PT-2026-42521

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description The software contains a hardcoded WhitePages reverse-phone API key within the wp1.php file, which is committed to the public source repository. An attacker with read access to the source...

Ticket Trust Management Vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a vulnerability related to trust management. This vulnerability stemmed from the hardcoding of a Google Maps API key in the tables.php file, which coul...

PT-2026-42523

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud...

Tickets: Cross-site scripting vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the ref and modeorig POST parameters in oswatch.php, allowing uncleane...

Tickets: Cross-site scripting vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the ticketid GET parameter in routesi.php, allowing uncleaned values t...

Tickets: Cross-site scripting vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the use of the id and ticketid GET parameters in the patientw.php file, allowing...

SQL Injection Vulnerabilities in Tickets

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a SQL injection vulnerability. This vulnerability stemmed from the fact that the POST parameters tickid and ftickid were directly concatenated into the...

CVE-2026-48243: Use of Hard-coded Credentials

Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the origin...

PT-2026-42504

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'os watch.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the ref and mo...

CVE-2026-48220: Improper Neutralization of Input During Web Page Generation

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

PT-2026-42498

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frm add str POST parameter directly into an HTML form hidden input value attribute...

CVE-2026-48224: Improper Neutralization of Input During Web Page Generation

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value through the frmaddstr POST parameter directly into an HTML form hidden input value attribute...

PT-2026-42502

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'ics214.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value via the frm add str PO...

Tickets: Cross-site scripting vulnerabilities

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from the circular.php file, where the frmid POST parameter was directly inserted into...

PT-2026-42493

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'circle.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing an unsanitized value through the frm id POS...