CVE-2026-48241
Hard-Coded MySQL Credentials in Open ISES Tickets
Publication date: 2026-05-21
Last updated on: 2026-05-21
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Open ISES Tickets versions before 3.44.2, where hardcoded MySQL database credentials are present in the file loader.php, which is a public-facing database utility.
Because these credentials are committed to the source repository, any actor who can access the public source tree or an unauthenticated attacker who can read the file on a deployed installation can obtain the username, password, and database name.
If the database is reachable from the attacker's network, they can use these credentials to connect to the database.
How can this vulnerability impact me? :
An attacker who obtains the hardcoded database credentials can connect to the database if it is accessible from their network.
This can lead to unauthorized access to sensitive data stored in the database, potentially resulting in data theft, data manipulation, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability exposes hardcoded MySQL database credentials in a public-facing file, allowing unauthorized actors to access sensitive database information if the database is reachable. Such unauthorized access to sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over access to personal and health information.
By enabling potential unauthorized database access, this vulnerability increases the risk of data breaches, which can result in non-compliance with these standards and regulations, potentially leading to legal and financial penalties.