Vulnerability · Published May 21, 2026 · Assigned by VulnCheck

CVE-2026-48241Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php

High 8.1

In plain English

A high-severity hard-coded credentials in Tickets from Open ISES. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

Affected products (as reported)

Vendor	Product	Versions
Open ISES	Tickets	0 – before 3.44.2

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/openises/tickets/releases/tag/v3.44.2 release-notes
https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff patch
https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-mysql-credentials-in-loader-php third-party-advisory