PT-2026-42519 · Openises · Tickets

Publicado 2026-05-21 · Atualizado 2026-05-21 · CVE-2026-48241

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2026-48241

Produtos afetados

Tickets

Referências · 4

• https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff · Correção
• https://github.com/openises/tickets/releases/tag/v3.44.2 · Nota
• https://vulncheck.com/advisories/open-ises-tickets-hardcoded-mysql-credentials-in-loader-php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-48241 · Nota de Segurança