CVE-2026-48231

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters tablename, indexname, sortby are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements without sanitization. Authenticated...

PT-2026-42509

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description An issue exists in the 'tables.php' endpoint where multiple POST parameters, specifically tablename, indexname, and sortby, are concatenated into table or column identifiers within...

PT-2025-41255

Name of the Vulnerable Software and Affected Versions Novel-Plus versions up to 5.2.4 Description The software contains a Stored Cross-Site Scripting XSS issue. Authenticated attackers can inject malicious JavaScript code through the indexName parameter of the /author/updateIndexName API endpoint...