CVE-2026-48242CWE-798hardcoded-credentials

CVE-2026-48242

High · published May 21, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00508 · 42.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-05-21T22:16Z
References (3)
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff · [email protected]https://github.com/openises/tickets/releases/tag/v3.44.2 · [email protected]https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-mysql-credentials-in-import-mdb-php · [email protected]
EPSS history
Timeline
  • 21 MAY 17:11Z
    Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php
    cvelistv5