Open ISES Tickets before 3.44.2 embeds the MySQL database host, username, password, and database name directly in the source file import_mdb.php. Because these credentials are committed to the public repository, any observer of the code can read them. If the credentials mirror those used in a deployed installation, an attacker who obtains the source can establish a direct database connection and read or modify data, compromising both confidentiality and integrity.

The vulnerability affects the Open ISES Tickets application, specifically versions earlier than 3.44.2. All installations of these pre‑3.44.2 releases that use the default hardcoded credentials are at risk.

The CVSS base score of 9.2 indicates a critical severity. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, but the ease of obtaining the credentials from the public source and the high impact of database compromise suggest that exploitation is probable in environments that have not changed the defaults. The likely attack vector is a passive read of the source code followed by an active database connection attempt that succeeds if the credentials match the target's configuration.