CVE-2026-48236 is a SQL injection vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in db_loader.php where POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are used unsafely in constructing mysqli connection arguments and dynamic SQL queries. Because these inputs are not sanitized, authenticated users can manipulate SQL commands to alter query semantics, enabling unauthorized reading, modification, or deletion of database data. The vulnerability has a CVSS 4.0 score of 7.1, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality with limited impact on integrity.

Successful exploitation allows an authenticated attacker to execute SQL injection attacks against the backend database, potentially leading to unauthorized data disclosure, data modification, or data destruction. This compromises the confidentiality and integrity of the database managed by Open ISES Tickets. There is no indication of availability impact. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restrict access to the affected db_loader.php functionality to trusted users only and consider implementing web application firewall rules to detect and block suspicious SQL injection attempts targeting these parameters.