HarborGuard / CVE
Back to search
CRITICALCVE-2026-48241Published Modified CNA VulnCheck

CVE-2026-48241: Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

Metrics

CVSS v4.0
9.2
Severity
CRITICAL
Fixed in
3.44.2
Affected Products
1

Fix available

3.44.2
Patch commits
Affected packages
  • Open ISES / Tickets
    < 3.44.2 (from 0)
CVSS Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References