by Kastro
Paper/Archive/CVE-2026-48242

CVE-2026-48242

Open ISES Tickets — Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php

EPSS 0.3%CVSS 9.2
critical.is priorityof 100
32
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 22.4.224 × 204.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.

Affected

ProductAffectedFixed inSource
Tickets< 3.44.23.44.2CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/openises/tickets/releases/tag/v3.44.2patchgithub.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbffwriteupvulncheck.com/advisories/open-ises-tickets-hardcoded-mysql-credentials-in-import-mdb-php