CVE-2026-48235 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The vulnerability exists in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking XML/JSON responses are concatenated unsafely into SQL statements. This allows an attacker controlling or impersonating the GPS tracker endpoint to inject SQL commands that affect responder location, tracks, and assignment tables. The CVSS 4.0 base score is 8.8, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation could allow an attacker to manipulate critical database tables related to responder location and assignments, potentially disrupting emergency response operations or corrupting tracking data. The vulnerability does not require privileges or user interaction and can be exploited remotely via the GPS tracking data source. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting or validating incoming GPS tracking data sources to trusted endpoints only to reduce risk. Monitor vendor channels for updates regarding patches or official mitigations.