CVE-2026-48241 Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-48241?
CVE-2026-48241 is a critical vulnerability in Open ISES Tickets, published on 21 May 2026.
Official description
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.
Weakness: CWE-798
Which versions are affected by CVE-2026-48241?
How do I fix CVE-2026-48241?
No fix has been published for CVE-2026-48241 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-48241 being exploited?
There is no known exploitation of CVE-2026-48241 in the wild and no public exploit code.
Sources
Also known as GHSA-3m3w-vxfv-jm2w.