CVE-2026-48241 Details
Description
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.
A vulnerability exists in Open ISES Tickets versions prior to 3.44.2, where hardcoded MySQL database credentials are exposed in loader.php, a public-facing database utility. These credentials, including the username, password, and database name, are committed to the source repository. Any actor with access to the public source tree or an unauthenticated attacker with read access to the file on a deployed installation can retrieve this information and use it to connect to the database if it is reachable from their network.
Users are advised to upgrade to Open ISES Tickets version 3.44.2 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 21, 2026CISA-ADP
Assessed May 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff | [email protected] | Source CodeVendor |
| https://github.com/openises/tickets/releases/tag/v3.44.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-mysql-credentials-in-loader-php | [email protected] | AdvisoryBroken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Open ISES Tickets | < 3.44.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | New CVE Received | [email protected] |