Open ISES has 37 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 37 in the 90 before. The busiest recent month was May 2026 with 37. The median CVSS is 5.4 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (18) and CWE-89 (10).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.4
- Publish → KEV
- —
- Last 90 days
- 0 prev 37
Worst active — by depth score
CVE-2026-48242High· 8.1Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php45CVE-2026-48241High· 8.1Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php45CVE-2026-48235High· 8.2Open ISES Tickets < 3.44.2 SQL Injection in incs/remotes.inc.php via External GPS Tracker Data45CVE-2026-48240High· 7.1Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters39CVE-2026-48239High· 7.1Open ISES Tickets < 3.44.2 SQL Injection via ajax/reports.php tick_id Parameter39
Open ISES vulnerabilities
CVEs affecting Open ISES, newest first. Open any entry for full detail, references, and exploit status.
37 CVEsRSS
CVE-2026-48240High· 7.1Open ISES Tickets < 3.44.2 SQL Injection via ajax/statistics.php tick_id and f_tick_id Parameters
Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements in the statistics rollup queries witho…
CVE-2026-48245Medium· 5.3Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platfo…
CVE-2026-48244Medium· 5.3Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php
Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps …
CVE-2026-48248Medium· 5.9Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/login.inc.php
Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests issued during the login/…
CVE-2026-48247Medium· 5.9Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in incs/functions.inc.php
Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for general-purpose …
CVE-2026-48246Medium· 5.9Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in ajax/reports.php
Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions…
CVE-2026-48249Medium· 5.9Open ISES Tickets < 3.44.2 Disabled TLS Certificate Verification in rm/incs/mobile_login.inc.php
Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests issued during …