CVE-2026-48232 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The issue is located in ajax/fullsit_incidents.php where the offset parameter from GET requests is concatenated directly into the LIMIT clause of a SQL query without sanitization. This improper neutralization of special elements allows authenticated users to manipulate SQL queries, potentially compromising database integrity and confidentiality. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Exploitation of this vulnerability allows authenticated attackers to alter SQL query semantics, which can lead to unauthorized reading, modification, or destruction of database contents. This compromises the confidentiality, integrity, and availability of the affected system's data. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected functionality to trusted users only and consider implementing web application firewall (WAF) rules to detect and block suspicious SQL injection attempts targeting the offset parameter. Avoid using vulnerable versions of Open ISES Tickets in production environments if possible.