CVE-2015-3001
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express...
CVE-2015-3001 is a medium vulnerability (CVSS 5.0) in Sysaid, published June 8, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.78%, the 93rd percentile. No source names a fixed version.
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
Exploit likelihood
What each source reports
NVD Score used
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
- Record
CVE-2015-3001- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
- Record
CVE-2015-3001- Updated
- 2026-11-02
EUVDEUVD-2015-3083 No score
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
- Record
EUVD-2015-3083- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p93v-grp7-c85h No score
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express...
SysAid Help Desk before 15.2 uses a hardcoded password of Password1 for the sa SQL Server Express user account, which allows remote authenticated users to bypass intended access restrictions by leveraging knowledge of this password.
- Record
GHSA-p93v-grp7-c85h- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SysAid Help Desk 14.4 - Multiple Vulnerabilities | 2015-06-10 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
seclists.org/fulldisclosure/2015/Jun/8
securityfocus.com/archive/1/535679/100/0/threaded
packetstormsecurity.com/files/132138/SysAid-Help-Desk-14.4-Code-Execution-Denial-Of-Service-Traversal-SQL-Injection.html
sysaid.com/blog/entry/sysaid-15-2-your-voice-your-service-desk
nvd.nist.gov/vuln/detail/CVE-2015-3001
github.com/advisories/GHSA-p93v-grp7-c85h