CVE-2002-1886

CVE-2002-1886 describes an information disclosure vulnerability in TightAuction 3.0, where the config.inc file is stored in the web document root with inadequate access controls. This allows unauthenticated remote attackers to retrieve sensitive database credentials, including the username and password. The vulnerability has a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), indicating a network-based attack with low complexity, requiring no authentication, and resulting in partial confidentiality impact. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.