CVE-2026-48236

Open ISES Tickets before 3.44.2 contains a SQL injection in db_loader.php where multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and used in dynamic SQL against an attacker‑controlled database without sanitization. A...