CVE-2026-48235 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The vulnerability exists in incs/remotes.inc.php where GPS tracking data fields (latitude, longitude, callsign, mph, altitude, timestamp) parsed from external XML/JSON responses are concatenated into SQL UPDATE and INSERT statements without proper sanitization or parameterization. An attacker able to control or spoof the remote GPS tracker endpoint can inject malicious SQL to alter responder location, tracks, and assignment tables in the backend database.

Successful exploitation allows an unauthenticated attacker who can compromise or impersonate the GPS tracking data source to execute arbitrary SQL commands on the Open ISES Tickets database. This can lead to unauthorized modification of responder location data, tracking information, and assignment records, potentially disrupting incident response operations or corrupting critical data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the GPS tracking data endpoints and validate or sanitize all incoming GPS data before it is used in SQL queries. Monitor for unusual database activity related to responder location and assignment tables.