CVE-2026-48242
Open ISES Tickets versions before 3.44.2 contain hardcoded MySQL database credentials in the import_mdb.php file. These credentials are stored in the public source code repository, so anyone who can read the code can obtain valid connection details. The exposed credentials could allow an attacker to access the database directly.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running Open ISES Tickets versions older than 3.44.2, especially those who have not removed the hardcoded credentials from the source code.
Real-world impact
An attacker who discovers the hardcoded credentials can connect to the MySQL database, read sensitive data, and potentially modify or delete records, compromising the integrity and confidentiality of the application’s data.
Why this severity
The CVSS score of 9.2 reflects the high impact of exposed credentials that grant full access to the database. Because the attacker can read, modify, or delete data without any authentication, the vulnerability scores high for confidentiality, integrity, and availability.
What to do about it
- ›Inspect the import_mdb.php file for hardcoded database credentials and replace them with secure, non-hardcoded configuration.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- May 21, 2026 · May 21, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.