Common Weakness Enumeration
CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
420 vulnerabilities reference this CWE, most recent first.
CVE-2026-14867 (GCVE-0-2026-14867)
Vulnerability from cvelistv5 – Published: 2026-07-07 09:25 – Updated: 2026-07-07 12:09
VLAI
EPSS
VEX
Title
Insecure password storage in User directory
Summary
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.
Active Directory accounts are not affected by this vulnerability.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CNA · arcinfo (v2.0.3)
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-07 12:08 UTC
CWE
- CWE-256 - Plaintext storage of a password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.pcvue.com/security/#SB2026-5 | vendor-advisory |
Impacted products
Date Public
2026-07-06 22:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-07T12:08:53.050760Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T12:09:29.277Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "PcVue",
"vendor": "arcinfo",
"versions": [
{
"lessThan": "17.0.0",
"status": "affected",
"version": "0",
"versionType": "cpe"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:arcinfo:pcvue:*:*:*:*:*:*:*:*",
"versionEndExcluding": "17.0.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"datePublic": "2026-07-06T22:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all\u0026nbsp;versions prior to 17.0.0. A local attacker could retrieve users\u2019 credentials.\u003cdiv\u003e\u0026nbsp;\n\u003cbr\u003eActive Directory accounts are not affected by this vulnerability.\u003c/div\u003e"
}
],
"value": "Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all\u00a0versions prior to 17.0.0. A local attacker could retrieve users\u2019 credentials.\u00a0\n\nActive Directory accounts are not affected by this vulnerability."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No POC available."
}
],
"value": "No POC available."
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Not known to be exploited"
}
],
"value": "Not known to be exploited"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CNA",
"version": "2.0.3"
},
"type": "ssvc"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext storage of a password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-07T09:25:57.741Z",
"orgId": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
"shortName": "arcinfo"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.pcvue.com/security/#SB2026-5"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eHarden the configuration\u003c/b\u003e\u003cbr\u003e\u003cu\u003eWho should apply this recommendation:\u003c/u\u003e All users\u003cbr\u003e\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n\u003cul\u003e\u003cli\u003eMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks.\u003c/li\u003e\u003cli\u003eLocate control system networks and remote devices behind firewalls and isolate them from business networks.\u003c/li\u003e\u003cli\u003eWhen remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003eAdditional deployment guidance and recommended practices are available in the product documentation (\u003ca href=\"https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/hardening-guide/overview.php\"\u003eHardening Guide\u003c/a\u003e).\u003c/div\u003e\u003cbr\u003e\u003cb\u003eUpdate PcVue\u003c/b\u003e\u003cbr\u003e\u003cu\u003eWho should apply this recommendation:\u003c/u\u003e All users using the affected component \u003cbr\u003e\u003cbr\u003eApply the corrective update by installing PcVue Initial Release 17.0.0 or later\n\u003cbr\u003eIn a patched release, it will no longer be possible to load User directory from earlier versions. Existing projects designed with an earlier version require explicit migration using the ProjectUtility CLI tool. Instructions are provided in the product documentation (\u003ca href=\"https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/tools/project-utility-cli.php\"\u003eProject Utility CLI reference\u003c/a\u003e).\n\u003cbr\u003eTo verify that the patch is applied correctly, you must check that the File version property of the file ./bin/sv32.exe matches release 17.0.0 (17.0.0902.3726) or later, and ensure that any earlier release is no longer used.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\n\n\u003cb\u003eAvailable patches:\u003c/b\u003e\u003cbr\u003ePatch provided in:\u003cbr\u003e\u003cul\u003e\u003cli\u003ePcVue 17.0.0 (17.0.0902.3726)\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "Harden the configuration\nWho should apply this recommendation: All users\n\n\nTo reduce the risk of exploitation, ARC Informatique strongly recommends implementing the following defensive measures:\n\n * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from insecure networks.\n * Locate control system networks and remote devices behind firewalls and isolate them from business networks.\n * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.\n\n\nAdditional deployment guidance and recommended practices are available in the product documentation ( Hardening Guide https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/hardening-guide/overview.php ).\n\n\nUpdate PcVue\nWho should apply this recommendation: All users using the affected component \n\nApply the corrective update by installing PcVue Initial Release 17.0.0 or later\n\nIn a patched release, it will no longer be possible to load User directory from earlier versions. Existing projects designed with an earlier version require explicit migration using the ProjectUtility CLI tool. Instructions are provided in the product documentation ( Project Utility CLI reference https://www.pcvue.com/ProductHelp/PcVue/en/Content/Deployment/tools/project-utility-cli.php ).\n\nTo verify that the patch is applied correctly, you must check that the File version property of the file ./bin/sv32.exe matches release 17.0.0 (17.0.0902.3726) or later, and ensure that any earlier release is no longer used.\n\n\n\n\nAvailable patches:\nPatch provided in:\n * PcVue 17.0.0 (17.0.0902.3726)"
}
],
"source": {
"advisory": "SB2026-5",
"discovery": "UNKNOWN"
},
"title": "Insecure password storage in User directory",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
"assignerShortName": "arcinfo",
"cveId": "CVE-2026-14867",
"datePublished": "2026-07-07T09:25:57.741Z",
"dateReserved": "2026-07-06T13:45:31.176Z",
"dateUpdated": "2026-07-07T12:09:29.277Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6597 (GCVE-0-2026-6597)
Vulnerability from cvelistv5 – Published: 2026-04-20 02:30 – Updated: 2026-04-20 11:42
VLAI
EPSS
VEX
Title
langflow-ai langflow Flow Using API core.py has_api_terms credentials storage
Summary
A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-20 11:42 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/358232 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/358232/cti | signaturepermissions-required |
| https://vuldb.com/submit/791920 | third-party-advisory |
| https://gist.github.com/chenhouser2025/b93261c6e6… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| langflow-ai | langflow |
Affected:
1.8.0
Affected: 1.8.1 Affected: 1.8.2 Affected: 1.8.3 cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-20T11:42:17.805708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T11:42:32.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*"
],
"modules": [
"Flow Using API"
],
"product": "langflow",
"vendor": "langflow-ai",
"versions": [
{
"status": "affected",
"version": "1.8.0"
},
{
"status": "affected",
"version": "1.8.1"
},
{
"status": "affected",
"version": "1.8.2"
},
{
"status": "affected",
"version": "1.8.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Eric-d (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflow/api/utils/core.py of the component Flow Using API. This manipulation causes unprotected storage of credentials. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-20T02:30:14.803Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-358232 | langflow-ai langflow Flow Using API core.py has_api_terms credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/358232"
},
{
"name": "VDB-358232 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/358232/cti"
},
{
"name": "Submit #791920 | Langflow \u003c= 1.8.3 Information Disclosure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/791920"
},
{
"tags": [
"exploit"
],
"url": "https://gist.github.com/chenhouser2025/b93261c6e651f14800a4f2e4365f357b"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-04-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-04-19T15:52:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "langflow-ai langflow Flow Using API core.py has_api_terms credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-6597",
"datePublished": "2026-04-20T02:30:14.803Z",
"dateReserved": "2026-04-19T13:46:59.741Z",
"dateUpdated": "2026-04-20T11:42:32.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6500 (GCVE-0-2026-6500)
Vulnerability from cvelistv5 – Published: 2026-05-04 14:16 – Updated: 2026-05-04 15:31
VLAI
EPSS
VEX
Summary
Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.
This issue affects OpenConcerto: 1.7.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-04 15:31 UTC
CWE
- CWE-256 - Plaintext storage of a password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.openconcerto.org/fr/version-1.7.html | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ILM Informatique | OpenConcerto |
Affected:
1.7.5
|
Date Public
2026-05-04 14:12
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6500",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-04T15:31:35.297408Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T15:31:41.588Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.openconcerto.org/fr/telechargement.html",
"defaultStatus": "unknown",
"product": "OpenConcerto",
"vendor": "ILM Informatique",
"versions": [
{
"status": "affected",
"version": "1.7.5"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dominique Righetto"
}
],
"datePublic": "2026-05-04T14:12:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.\u003cp\u003eThis issue affects OpenConcerto: 1.7.5.\u003c/p\u003e"
}
],
"value": "Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.\n\nThis issue affects OpenConcerto: 1.7.5."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext storage of a password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-04T14:16:41.970Z",
"orgId": "64c5ae8f-7972-4697-86a0-7ada793ac795",
"shortName": "TCS-CERT"
},
"references": [
{
"tags": [
"product"
],
"url": "https://www.openconcerto.org/fr/version-1.7.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "64c5ae8f-7972-4697-86a0-7ada793ac795",
"assignerShortName": "TCS-CERT",
"cveId": "CVE-2026-6500",
"datePublished": "2026-05-04T14:16:41.970Z",
"dateReserved": "2026-04-17T09:34:00.554Z",
"dateUpdated": "2026-05-04T15:31:41.588Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4251 (GCVE-0-2026-4251)
Vulnerability from cvelistv5 – Published: 2026-03-16 16:02 – Updated: 2026-03-16 18:17
VLAI
EPSS
VEX
Title
CityData CityChat ai.citydata.citychat credentials.json credentials storage
Summary
A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:17 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351209 | vdb-entry |
| https://vuldb.com/?ctiid.351209 | signaturepermissions-required |
| https://vuldb.com/?submit.771436 | third-party-advisory |
| https://www.notion.so/Google-Cloud-Service-Accoun… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4251",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:17:44.521821Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:17:54.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"ai.citydata.citychat"
],
"product": "CityChat",
"vendor": "CityData",
"versions": [
{
"status": "affected",
"version": "0.12.0"
},
{
"status": "affected",
"version": "0.12.1"
},
{
"status": "affected",
"version": "0.12.2"
},
{
"status": "affected",
"version": "0.12.3"
},
{
"status": "affected",
"version": "0.12.4"
},
{
"status": "affected",
"version": "0.12.5"
},
{
"status": "affected",
"version": "0.12.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/assets/flutter_assets/assets/credentials.json of the component ai.citydata.citychat. Executing a manipulation can lead to unprotected storage of credentials. The attack requires local access. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T16:02:08.596Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351209 | CityData CityChat ai.citydata.citychat credentials.json credentials storage",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.351209"
},
{
"name": "VDB-351209 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351209"
},
{
"name": "Submit #771436 | CITYDATA CityChat(ai.citydata.citychat) 0.12.6 Google Cloud Service Account Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771436"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Dialogflow-Data-Access-in-ai-citydata-citychat-3192de3f97fb80ca9739ebc6329c8449?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-16T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:16:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "CityData CityChat ai.citydata.citychat credentials.json credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4251",
"datePublished": "2026-03-16T16:02:08.596Z",
"dateReserved": "2026-03-16T06:10:42.442Z",
"dateUpdated": "2026-03-16T18:17:54.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4250 (GCVE-0-2026-4250)
Vulnerability from cvelistv5 – Published: 2026-03-16 15:32 – Updated: 2026-03-16 18:12
VLAI
EPSS
VEX
Title
Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage
Summary
A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/assets/service-account.json of the component Google Cloud Service Account Key Handler. Performing a manipulation results in unprotected storage of credentials. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:11 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351208 | vdb-entry |
| https://vuldb.com/?ctiid.351208 | signaturepermissions-required |
| https://vuldb.com/?submit.771435 | third-party-advisory |
| https://www.notion.so/Google-Cloud-Service-Accoun… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Albert Sağlık Hizmetleri ve Ticaret | Albert Health |
Affected:
1.7.0
Affected: 1.7.1 Affected: 1.7.2 Affected: 1.7.3 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4250",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:11:17.072584Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:12:04.287Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Google Cloud Service Account Key Handler"
],
"product": "Albert Health",
"vendor": "Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret",
"versions": [
{
"status": "affected",
"version": "1.7.0"
},
{
"status": "affected",
"version": "1.7.1"
},
{
"status": "affected",
"version": "1.7.2"
},
{
"status": "affected",
"version": "1.7.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/assets/service-account.json of the component Google Cloud Service Account Key Handler. Performing a manipulation results in unprotected storage of credentials. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:32:08.686Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351208 | Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.351208"
},
{
"name": "VDB-351208 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351208"
},
{
"name": "Submit #771435 | albertHealth Albert Health(albert.health) 1.7.3 Google Cloud Service Account Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771435"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Google-Cloud-Service-Account-Key-Exposure-Leading-to-Unauthorized-Data-Access-in-albert-health-3192de3f97fb800d8ebddef9f259223b?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-16T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-16T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:16:17.000Z",
"value": "VulDB entry last update"
}
],
"title": "Albert Sa\u011fl\u0131k Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4250",
"datePublished": "2026-03-16T15:32:08.686Z",
"dateReserved": "2026-03-16T06:06:30.949Z",
"dateUpdated": "2026-03-16T18:12:04.287Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4243 (GCVE-0-2026-4243)
Vulnerability from cvelistv5 – Published: 2026-03-16 15:02 – Updated: 2026-03-16 18:18
VLAI
EPSS
VEX
Title
La Nacion App app.lanacion.activity BuildConfig.java credentials storage
Summary
A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:18 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351185 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351185 | signaturepermissions-required |
| https://vuldb.com/?submit.771432 | third-party-advisory |
| https://www.notion.so/WebSocket-Credential-Leak-L… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | La Nacion App |
Affected:
10.2.25
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4243",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:18:16.241233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:18:28.414Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app.lanacion.activity"
],
"product": "La Nacion App",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "10.2.25"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.java of the component app.lanacion.activity. Executing a manipulation of the argument API_KEY_WEBSOCKET_CV can lead to unprotected storage of credentials. The attack can only be executed locally. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:02:07.721Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351185 | La Nacion App app.lanacion.activity BuildConfig.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351185"
},
{
"name": "VDB-351185 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351185"
},
{
"name": "Submit #771432 | SA LA NACION LA NACION(app.lanacion.activity) 10.2.25 WebSocket Credential Leak",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771432"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/WebSocket-Credential-Leak-Leading-to-Potential-DDoS-Attacks-in-app-lanacion-activity-3192de3f97fb80f8add6c2247abeb4eb?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-15T21:53:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "La Nacion App app.lanacion.activity BuildConfig.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4243",
"datePublished": "2026-03-16T15:02:07.721Z",
"dateReserved": "2026-03-15T20:48:26.368Z",
"dateUpdated": "2026-03-16T18:18:28.414Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4242 (GCVE-0-2026-4242)
Vulnerability from cvelistv5 – Published: 2026-03-16 14:32 – Updated: 2026-03-16 18:41
VLAI
EPSS
VEX
Title
BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage
Summary
A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 18:41 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351184 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351184 | signaturepermissions-required |
| https://vuldb.com/?submit.771429 | third-party-advisory |
| https://www.notion.so/Segment-Write-Key-Exposure-… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| BabyChakra | Pregnancy & Parenting App |
Affected:
5.4.0
Affected: 5.4.1 Affected: 5.4.2 Affected: 5.4.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4242",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T18:41:11.426519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T18:41:38.452Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"app.babychakra.babychakra"
],
"product": "Pregnancy \u0026 Parenting App",
"vendor": "BabyChakra",
"versions": [
{
"status": "affected",
"version": "5.4.0"
},
{
"status": "affected",
"version": "5.4.1"
},
{
"status": "affected",
"version": "5.4.2"
},
{
"status": "affected",
"version": "5.4.3.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in BabyChakra Pregnancy \u0026 Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file\u00a0app/babychakra/babychakra/Configuration.java of the component app.babychakra.babychakra. Performing a manipulation of the argument SEGMENT_WRITE_KEY results in unprotected storage of credentials. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T14:32:08.907Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351184 | BabyChakra Pregnancy \u0026 Parenting App app.babychakra.babychakra Configuration.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351184"
},
{
"name": "VDB-351184 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351184"
},
{
"name": "Submit #771429 | BabyChakra Pregnancy \u0026 Parenting App(app.babychakra.babychakra) 5.4.3.0 Segment Write Key Exposure",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.771429"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Segment-Write-Key-Exposure-Leading-to-Data-Injection-and-User-Profile-Manipulation-In-app-babychakra-3192de3f97fb8084b6b5cb06f96cdf57?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:33:57.000Z",
"value": "VulDB entry last update"
}
],
"title": "BabyChakra Pregnancy \u0026 Parenting App app.babychakra.babychakra Configuration.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4242",
"datePublished": "2026-03-16T14:32:08.907Z",
"dateReserved": "2026-03-15T20:46:40.333Z",
"dateUpdated": "2026-03-16T18:41:38.452Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-4217 (GCVE-0-2026-4217)
Vulnerability from cvelistv5 – Published: 2026-03-16 05:02 – Updated: 2026-03-16 15:29
VLAI
EPSS
VEX
Title
XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage
Summary
A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unprotected storage of credentials. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-16 15:29 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.351141 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.351141 | signaturepermissions-required |
| https://vuldb.com/?submit.770503 | third-party-advisory |
| https://www.notion.so/Exposed-Cryptographic-Key-a… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XREAL | Nebula App |
Affected:
3.2.0
Affected: 3.2.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-4217",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-16T15:29:47.821375Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T15:29:54.628Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"ai.nreal.nebula.universal"
],
"product": "Nebula App",
"vendor": "XREAL",
"versions": [
{
"status": "affected",
"version": "3.2.0"
},
{
"status": "affected",
"version": "3.2.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "fxizenta (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in\u00a0ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument accessKey/secretAccessKey/securityToken leads to unprotected storage of credentials. The attack can only be performed from a local environment. The attack requires a high level of complexity. The exploitability is said to be difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1,
"vectorString": "AV:L/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-16T06:28:07.599Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-351141 | XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.351141"
},
{
"name": "VDB-351141 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.351141"
},
{
"name": "Submit #770503 | XREAL Technology Limited Nebula 3.2.1 Exposed Cryptographic Key and IV",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.770503"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/Exposed-Cryptographic-Key-and-IV-in-ai-nreal-nebula-universal-3172de3f97fb80b5a987eac2c49527e2?source=copy_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-03-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-03-16T07:32:59.000Z",
"value": "VulDB entry last update"
}
],
"title": "XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-4217",
"datePublished": "2026-03-16T05:02:10.796Z",
"dateReserved": "2026-03-15T15:14:12.416Z",
"dateUpdated": "2026-03-16T15:29:54.628Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0017
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records
Summary
----------------------------------------------------------------------------
NotCVE Advisory — NotCVE-2026-0012
----------------------------------------------------------------------------
[-] Summary:
kamalpanse18 EmpManageX, a Flask-based employee management application,
ships hard-coded administrative credentials in its authentication logic.
The username admin and the plaintext password admin123 are module-level
constants in app.py, compared directly against the values submitted to the
/api/login handler. An attacker who can reach the listener authenticates as
the sole administrator and obtains full read and write control of every
employee record. The credentials are not a guessable secret: the project's
own README.md and QUICK_START.md state them openly. As shipped the server
binds to 127.0.0.1 only, so the default exposure is local; a deployer who
binds an external interface makes the same defect remotely reachable.
CVSS:3.1 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
[-] Affected:
kamalpanse18 EmpManageX, all versions (app.py).
The repository has a single commit, f4de83b, dated 2025-12-31, and no
tagged releases. No fixed version is currently verified.
[-] Technical Description:
ADMIN_USERNAME and ADMIN_PASSWORD are assigned at lines 17-18 of app.py and
compared directly against the submitted values in the /api/login handler.
The credential pair is a source-level constant with no configuration
mechanism behind it: app.py contains no use of os.environ or os.getenv, no
configuration file, no first-run setup step and no password-change
endpoint. The only supported way to alter the administrator password is to
edit the source and restart the process, and that change is lost whenever
the deployment is refreshed from the upstream repository. The same value is
therefore present in every unmodified deployment, and because README.md and
QUICK_START.md state it openly it is a published constant rather than a
guessable secret.
A successful call to /api/login sets session['logged_in'], which is the
only condition tested by the login_required decorator. No further
authorisation check is performed, so the caller obtains the entire
protected surface: POST /api/employee (create), GET /api/employees and
GET /api/employee/<int:emp_id> (read all stored employee data),
PUT /api/employee/<int:emp_id> (modify) and
DELETE /api/employee/<int:emp_id> (delete). On a match the handler sets
session['user_id'], session['username'] and session['logged_in'] and
returns a signed session cookie marked permanent with a 24-hour lifetime,
which the caller can replay against the protected endpoints.
The entry point is app.run(debug=True, port=5000), which passes no host
argument and therefore binds the Werkzeug development server to 127.0.0.1
only; README.md, SETUP_GUIDE.md and QUICK_START.md all direct the user to
http://127.0.0.1:5000. In the configuration as shipped the endpoint is
reachable only from the local host, which is what the CVSS vector above
reflects. A deployer who binds 0.0.0.0 or places the application behind a
reverse proxy makes the same defect remotely reachable.
SETUP_GUIDE.md carries a "Security Recommendations for Production" section
suggesting that the credentials be read from environment variables, but
that guidance is not implemented in the shipped app.py, and the example it
gives retains admin/admin123 as the fallback default.
The step-by-step attack path and the full write-up are published at the
advisory URL below.
Weaknesses:
CWE-798: Use of Hard-coded Credentials
CWE-1392: Use of Default Credentials
CWE-256: Plaintext Storage of a Password
CAPEC-70: Try Common or Default Usernames and Passwords
[-] Timeline:
[29/07/2026] - Report received and NotCVE ID reserved.
[20/08/2026] - Published as NotCVE-2026-0012.
[-] Credit:
Discovered by netspacer1124.
[-] Full Details and Updates:
https://notcve.org/notcve/NotCVE-2026-0012
[-] References:
https://github.com/kamalpanse18/EmpManageX
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md
https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md
https://github.com/kamalpanse18/EmpManageX/commits/main/app.py
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
15 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| unknown | EmpManageX Hardcoded Administrative |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "EmpManageX Hardcoded Administrative",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Advisory \u2014 NotCVE-2026-0012\n----------------------------------------------------------------------------\n\n[-] Summary:\nkamalpanse18 EmpManageX, a Flask-based employee management application,\nships hard-coded administrative credentials in its authentication logic.\nThe username admin and the plaintext password admin123 are module-level\nconstants in app.py, compared directly against the values submitted to the\n/api/login handler. An attacker who can reach the listener authenticates as\nthe sole administrator and obtains full read and write control of every\nemployee record. The credentials are not a guessable secret: the project\u0027s\nown README.md and QUICK_START.md state them openly. As shipped the server\nbinds to 127.0.0.1 only, so the default exposure is local; a deployer who\nbinds an external interface makes the same defect remotely reachable.\nCVSS:3.1 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).\n\n[-] Affected:\nkamalpanse18 EmpManageX, all versions (app.py).\nThe repository has a single commit, f4de83b, dated 2025-12-31, and no\ntagged releases. No fixed version is currently verified.\n\n[-] Technical Description:\nADMIN_USERNAME and ADMIN_PASSWORD are assigned at lines 17-18 of app.py and\ncompared directly against the submitted values in the /api/login handler.\nThe credential pair is a source-level constant with no configuration\nmechanism behind it: app.py contains no use of os.environ or os.getenv, no\nconfiguration file, no first-run setup step and no password-change\nendpoint. The only supported way to alter the administrator password is to\nedit the source and restart the process, and that change is lost whenever\nthe deployment is refreshed from the upstream repository. The same value is\ntherefore present in every unmodified deployment, and because README.md and\nQUICK_START.md state it openly it is a published constant rather than a\nguessable secret.\n\nA successful call to /api/login sets session[\u0027logged_in\u0027], which is the\nonly condition tested by the login_required decorator. No further\nauthorisation check is performed, so the caller obtains the entire\nprotected surface: POST /api/employee (create), GET /api/employees and\nGET /api/employee/\u003cint:emp_id\u003e (read all stored employee data),\nPUT /api/employee/\u003cint:emp_id\u003e (modify) and\nDELETE /api/employee/\u003cint:emp_id\u003e (delete). On a match the handler sets\nsession[\u0027user_id\u0027], session[\u0027username\u0027] and session[\u0027logged_in\u0027] and\nreturns a signed session cookie marked permanent with a 24-hour lifetime,\nwhich the caller can replay against the protected endpoints.\n\nThe entry point is app.run(debug=True, port=5000), which passes no host\nargument and therefore binds the Werkzeug development server to 127.0.0.1\nonly; README.md, SETUP_GUIDE.md and QUICK_START.md all direct the user to\nhttp://127.0.0.1:5000. In the configuration as shipped the endpoint is\nreachable only from the local host, which is what the CVSS vector above\nreflects. A deployer who binds 0.0.0.0 or places the application behind a\nreverse proxy makes the same defect remotely reachable.\n\nSETUP_GUIDE.md carries a \"Security Recommendations for Production\" section\nsuggesting that the credentials be read from environment variables, but\nthat guidance is not implemented in the shipped app.py, and the example it\ngives retains admin/admin123 as the fallback default.\n\nThe step-by-step attack path and the full write-up are published at the\nadvisory URL below.\n\nWeaknesses:\nCWE-798: Use of Hard-coded Credentials\nCWE-1392: Use of Default Credentials\nCWE-256: Plaintext Storage of a Password\nCAPEC-70: Try Common or Default Usernames and Passwords\n\n[-] Timeline:\n[29/07/2026] - Report received and NotCVE ID reserved.\n[20/08/2026] - Published as NotCVE-2026-0012.\n\n[-] Credit:\nDiscovered by netspacer1124.\n\n[-] Full Details and Updates:\nhttps://notcve.org/notcve/NotCVE-2026-0012\n\n[-] References:\nhttps://github.com/kamalpanse18/EmpManageX\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md\nhttps://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md\nhttps://github.com/kamalpanse18/EmpManageX/commits/main/app.py\n\n[-] About NotCVE:\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1392",
"description": "CWE-1392",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-256",
"description": "CWE-256",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-798",
"description": "CWE-798",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:20Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/113"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/113"
},
{
"url": "http://127.0.0.1:5000"
},
{
"url": "https://github.com/kamalpanse18/EmpManageX"
},
{
"url": "https://github.com/kamalpanse18/EmpManageX/commits/main/app.py"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0012"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/QUICK_START.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/README.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/SETUP_GUIDE.md"
},
{
"url": "https://raw.githubusercontent.com/kamalpanse18/EmpManageX/main/app.py"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/113"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0012] EmpManageX Hardcoded Administrative Credentials in Login API Allow Full Access to Employee Records",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0017",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/113",
"automated": true,
"contentSha256": "c95c4d5678b820a7ef5f1419342a923a1af431905e7d094b5c6553d19da8dda2",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/113",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-21T10:27:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-07T13:20:20Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0017"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-65009 (GCVE-0-2025-65009)
Vulnerability from cvelistv5 – Published: 2025-12-18 15:10 – Updated: 2025-12-18 18:52
VLAI
EPSS
VEX
Title
Insecure Password Storage in WODESYS WD-R608U router
Summary
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthorized user by direct references to the resource in question.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-18 15:18 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.wodesys.com/eproductms52.html | product |
| https://cert.pl/en/posts/2025/12/CVE-2025-65007 | third-party-advisory |
| https://github.com/wcyb/security_research | exploit |
Impacted products
Date Public
2025-12-18 15:09
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-65009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-18T15:18:52.153666Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-18T18:52:06.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "WD-R608U",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WDR28",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "WDR122B V2.0",
"vendor": "WODESYS",
"versions": [
{
"status": "affected",
"version": "WDR28081123OV1.01",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wojciech Cybowski"
}
],
"datePublic": "2025-12-18T15:09:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In WODESYS WD-R608U router (also known as \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWDR122B V2.0 and WDR28)\u003c/span\u003e\u0026nbsp;\u003cspan style=\"background-color: rgba(221, 223, 228, 0.1);\"\u003eadmin password is stored in configuration file as plaintext\u003c/span\u003e\u0026nbsp;and can be obtained by unauthorized user by direct references to the resource in question.\u003cbr\u003e\u003cbr\u003eThe vendor was notified early about this vulnerability, but didn\u0027t respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.\u003cbr\u003e"
}
],
"value": "In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28)\u00a0admin password is stored in configuration file as plaintext\u00a0and can be obtained by unauthorized user by direct references to the resource in question.\n\nThe vendor was notified early about this vulnerability, but didn\u0027t respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-18T15:10:31.234Z",
"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"shortName": "CERT-PL"
},
"references": [
{
"tags": [
"product"
],
"url": "http://www.wodesys.com/eproductms52.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://cert.pl/en/posts/2025/12/CVE-2025-65007"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wcyb/security_research"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Insecure Password Storage in WODESYS WD-R608U router",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
"assignerShortName": "CERT-PL",
"cveId": "CVE-2025-65009",
"datePublished": "2025-12-18T15:10:31.234Z",
"dateReserved": "2025-11-13T09:42:15.302Z",
"dateUpdated": "2025-12-18T18:52:06.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Avoid storing passwords in easily accessible locations.
Mitigation
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.