CVE-2026-48235

Open ISES Tickets prior to 3.44.2 is vulnerable to SQL injection in incs/remotes.inc.php, where GPS-tracker data (latitude, longitude, callsign, mph, altitude, timestamp) parsed from external XML/JSON responses are concatenated into UPDATE/INSERT statements without sanitization. An attacker who c...

CVE-2026-48235 Open ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses InstaMapper and Google Latitude integration are concatenated into...