Open ISES vulnerabilities
We track 12 vulnerabilities in Open ISES products. 12 are rated high or critical, and none are known to be exploited. The most recent was published on May 21, 2026.
Latest Open ISES vulnerabilities
- 8.1 High severity
Tickets: Use of Hard-coded Credentials
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the sou
- 8.1 High severity
Tickets: Use of Hard-coded Credentials
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with rea
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries without sanitization. Authen
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement used as a ticket-existence sanity check without sanitization. Authenticated at
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE statements without sanitization. Authenticated attackers can craf
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into mysqli connection arguments and dynamic SQL operating agains
- 8.2 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracking service XML/JSON responses (InstaMapper and Google Latitud
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the ORDER BY clause of a SELECT statement without sanitization. Authenticated attackers can craf
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests that al
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without sanitization. Authenticated attackers can craft requests tha
- 7.1 High severity
Tickets: Improper Neutralization of Special Elements used in an SQL Command
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated into table/column identifiers in dynamically constructed SELECT/UPDATE/DELETE statements wit