CVE-2026-48243

Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php

CVSS 6.9 MEDIUMEPSS 0.2%CWE-798

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.9EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

21 may 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Productos afectados

Open ISES · Tickets

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff https://github.com/openises/tickets/releases/tag/v3.44.2 https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-whitepages-api-key-in-wp1-php