CVE-2026-48233 is a SQL injection vulnerability in Open ISES Tickets before version 3.44.2. The issue is located in ajax/sit_incidents.php where the offset GET parameter is unsafely concatenated into the LIMIT clause of a SQL SELECT statement. Because the input is not sanitized, authenticated users can craft malicious requests that alter the SQL query's logic, potentially leading to unauthorized reading, modification, or destruction of database data. The vulnerability is rated high severity with a CVSS 4.0 score of 7.1. No official fix or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows authenticated attackers to perform SQL injection attacks by manipulating the offset parameter, which can lead to unauthorized access to database information, modification of data, or data destruction. This compromises the confidentiality, integrity, and availability of the affected system's database contents. No known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected component to trusted users only and monitor for suspicious activity related to the offset parameter. Avoid exposing the vulnerable endpoint to untrusted networks. Follow up with the vendor for updates on patches or official mitigations.