Common Weakness Enumeration

CWE-312

Allowed

Cleartext Storage of Sensitive Information

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

1152 vulnerabilities reference this CWE, most recent first.

CVE-2026-4130 (GCVE-0-2026-4130)

Vulnerability from cvelistv5 – Published: 2026-09-10 15:38 – Updated: 2026-09-16 16:24

Title

Storage of Sensitive Information in Cleartext in NI SystemLink

Summary

There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server versions prior to 2026 Q3.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

8.4 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-11 00:00 UTC

CWE

CWE-312 - Cleartext storage of sensitive information

Assigner

NI CNA under the mitre root

CNA scorecard B 84/100 over 28 records in the last 180 days details

References

1 reference

URL	Tags
https://www.ni.com/en/support/security/available-…

Impacted products

2 products

Vendor	Product	Version
NI	SystemLink	Affected: 0 , < 26.5.0 (semver) cpe:2.3:a:ni:systemlink::::::::
NI	SystemLink Server	Affected: 0 , < 26.5.0 (semver) cpe:2.3:a:ni:systemlink_server::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4130",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-11T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-12T03:55:27.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SystemLink",
          "vendor": "NI",
          "versions": [
            {
              "lessThan": "26.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SystemLink Server",
          "vendor": "NI",
          "versions": [
            {
              "lessThan": "26.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ni:systemlink:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.5.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ni:systemlink_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "26.5.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.\u0026nbsp; This vulnerability affects NI SystemLink and NI SystemLink Server\u0026nbsp;versions prior to 2026 Q3.\u0026nbsp;"
            }
          ],
          "value": "There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear.\u00a0 This vulnerability affects NI SystemLink and NI SystemLink Server\u00a0versions prior to 2026 Q3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37 Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext storage of sensitive information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T16:24:48.195Z",
        "orgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
        "shortName": "NI"
      },
      "references": [
        {
          "url": "https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/storage-of-sensitive-information-in-cleartext-in-ni-systemlink.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Storage of Sensitive Information in Cleartext in NI SystemLink",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bca5b2e8-03a4-4781-b4ca-c6a078c0bfd4",
    "assignerShortName": "NI",
    "cveId": "CVE-2026-4130",
    "datePublished": "2026-09-10T15:38:34.057Z",
    "dateReserved": "2026-03-13T14:11:51.198Z",
    "dateUpdated": "2026-09-16T16:24:48.195Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3277 (GCVE-0-2026-3277)

Vulnerability from cvelistv5 – Published: 2026-02-27 15:11 – Updated: 2026-03-30 20:43

Summary

The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-27 17:26 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

DEVOLUTIONS CNA under the mitre root

CNA scorecard E 44/100 over 64 records in the last 180 days details

References

1 reference

URL	Tags
https://devolutions.net/security/advisories/DEVO-…

Impacted products

1 product

Vendor	Product	Version
Devolutions	PowerShell Universal	Affected: 0 , < 2026.1.3 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "NONE",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-3277",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-27T17:26:17.157053Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-30T20:43:33.695Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerShell Universal",
          "vendor": "Devolutions",
          "versions": [
            {
              "lessThan": "2026.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The OpenID Connect (OIDC) authentication configuration in PowerShell \nUniversal before 2026.1.3 stores the OIDC client secret in cleartext in \nthe \u003ccode\u003e.universal/authentication.ps1\u003c/code\u003e script, which allows an attacker with read access to that file to obtain the OIDC client credentials"
            }
          ],
          "value": "The OpenID Connect (OIDC) authentication configuration in PowerShell \nUniversal before 2026.1.3 stores the OIDC client secret in cleartext in \nthe .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-27T15:11:18.252Z",
        "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
        "shortName": "DEVOLUTIONS"
      },
      "references": [
        {
          "url": "https://devolutions.net/security/advisories/DEVO-2026-0006"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
    "assignerShortName": "DEVOLUTIONS",
    "cveId": "CVE-2026-3277",
    "datePublished": "2026-02-27T15:11:18.252Z",
    "dateReserved": "2026-02-26T15:29:18.531Z",
    "dateUpdated": "2026-03-30T20:43:33.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-3221 (GCVE-0-2026-3221)

Vulnerability from cvelistv5 – Published: 2026-02-25 18:29 – Updated: 2026-02-26 16:03

Summary

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.

Severity

4.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-02-26 16:02 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

DEVOLUTIONS CNA under the mitre root

CNA scorecard E 44/100 over 64 records in the last 180 days details

References

1 reference

URL	Tags
https://devolutions.net/security/advisories/DEVO-…

Impacted products

1 product

Vendor	Product	Version
Devolutions	Server	Affected: 0 , < 2025.3.15 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-3221",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-26T16:02:33.571666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T16:03:04.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Devolutions",
          "versions": [
            {
              "lessThan": "2025.3.15",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Sensitive\n user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with \naccess to the database to obtain sensitive user \ninformation via direct database access."
            }
          ],
          "value": "Sensitive\n user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with \naccess to the database to obtain sensitive user \ninformation via direct database access."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-25T18:29:11.939Z",
        "orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
        "shortName": "DEVOLUTIONS"
      },
      "references": [
        {
          "url": "https://devolutions.net/security/advisories/DEVO-2026-0004/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23",
    "assignerShortName": "DEVOLUTIONS",
    "cveId": "CVE-2026-3221",
    "datePublished": "2026-02-25T18:29:11.939Z",
    "dateReserved": "2026-02-25T18:20:33.439Z",
    "dateUpdated": "2026-02-26T16:03:04.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GCVE-1988-2026-0103

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-07 13:20

Title

Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312)

Summary

# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config # Date: 2026-07-16 # Exploit Author: Alireza Chegini # Vendor Homepage: https://ezsystemrepairs.com # Software Link: https://ezsystemrepairs.com (Free version available) # Version: 1.0.0 (v2.0 exists but not tested - paid license required) # Tested on: Windows 10 / Windows 11 # CVE: Pending ============================================================ 1. Description EZ Game Booster v1.0.0 stores user credentials (username, password, email, licenseKey) in plaintext within a .NET user.config file. This is a CWE-312 vulnerability allowing local credential theft. 2. Affected File Path C:\Users\%USERNAME%\AppData\Local\ezgamebooster\ ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\1.0.0.0\user.config 3. Exposed Fields (stored in cleartext) - username - password - email - fullname - licenseKey - machineCode 4. Sample user.config Structure The following is the exact content of the user.config file found on the researcher’s system: <?xml version="1.0" encoding="utf-8"?> <configuration> <userSettings> <ezgamebooster.My.MySettings> <setting name="username" serializeAs="String"> <value>nimaarek</value> </setting> <setting name="password" serializeAs="String"> <value>CanYouSeeMyPassword?!</value> </setting> <setting name="machineCode" serializeAs="String"> <value>N414NBC****BDBMB</value> </setting> <setting name="role" serializeAs="String"> <value>Free</value> </setting> <setting name="active" serializeAs="String"> <value>2026-07-15 16:38:52</value> </setting> <setting name="created_at" serializeAs="String"> <value>2026-07-15 16:38:52</value> </setting> <setting name="email" serializeAs="String"> <value>nim44r3k () gmail com</value> </setting> <setting name="fullname" serializeAs="String"> <value>AliReza Chegini</value> </setting> <setting name="subinfo" serializeAs="String"> <value>Basic</value> </setting> <setting name="usernameChanged" serializeAs="String"> <value>True</value> </setting> <setting name="rememberMe" serializeAs="String"> <value>True</value> </setting> <setting name="licenseKey" serializeAs="String"> <value>A325-****-B084-****</value> </setting> <setting name="isLoggedIn" serializeAs="String"> <value>False</value> </setting> </ezgamebooster.My.MySettings> </userSettings> </configuration> 5. Impact - Credential theft via local file read - Credential stuffing attacks on other platforms - License key theft for unauthorized activation 6. Steps to Reproduce a. Install and run EZ Game Booster v1.0.0 b. Create an account or log in c. Browse to: %LOCALAPPDATA%\ezgamebooster\ ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\1.0.0.0\ d. Open user.config with Notepad e. Observe plaintext password, email, and licenseKey 7. Remediation Encrypt sensitive data using DPAPI before serialization. Use Windows Credential Manager for credential storage. 8. Author's Note on Discovery "I discovered this while uninstalling the software and checking for leftover files. I was not performing any targeted security research at the time — I simply found my credentials in plaintext by accident." Best regards, AliReza Chegini - nimaarek nim44r3k () gmail com - priv8 () tuta io _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Severity

No CVSS data available.

CWE

CWE-312

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 445 records in the last 180 days details

References

5 references

URL	Tags
https://vuln.freearchive.org/archive/full-disclos…	technical-description
https://seclists.org/fulldisclosure/2026/Jul/21	technical-description
https://ezsystemrepairs.com
https://nmap.org/mailman/listinfo/fulldisclosure
https://seclists.org/fulldisclosure/

Impacted products

1 product

Vendor	Product	Version
unknown	Subject Advisory Submission	Affected: unknown

Credits

AliReza

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Subject Advisory Submission",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AliReza"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config\n# Date: 2026-07-16\n# Exploit Author: Alireza Chegini\n# Vendor Homepage: https://ezsystemrepairs.com\n# Software Link: https://ezsystemrepairs.com (Free version available)\n# Version: 1.0.0 (v2.0 exists but not tested - paid license required)\n# Tested on: Windows 10 / Windows 11\n# CVE: Pending\n============================================================\n\n1. Description\n   EZ Game Booster v1.0.0 stores user credentials (username, password,\n   email, licenseKey) in plaintext within a .NET user.config file.\n   This is a CWE-312 vulnerability allowing local credential theft.\n\n2. Affected File Path\n   C:\\Users\\%USERNAME%\\AppData\\Local\\ezgamebooster\\\n   ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\user.config\n\n3. Exposed Fields (stored in cleartext)\n   - username\n   - password\n   - email\n   - fullname\n   - licenseKey\n   - machineCode\n\n4. Sample user.config Structure\nThe following is the exact content of the user.config file found on\nthe researcher\u2019s system:\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cconfiguration\u003e\n\u003cuserSettings\u003e\n\u003cezgamebooster.My.MySettings\u003e\n\u003csetting name=\"username\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enimaarek\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"password\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eCanYouSeeMyPassword?!\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"machineCode\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eN414NBC****BDBMB\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"role\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFree\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"active\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"created_at\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"email\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enim44r3k () gmail com\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"fullname\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eAliReza Chegini\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"subinfo\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eBasic\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"usernameChanged\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"rememberMe\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"licenseKey\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eA325-****-B084-****\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"isLoggedIn\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFalse\u003c/value\u003e\n\u003c/setting\u003e\n\u003c/ezgamebooster.My.MySettings\u003e\n\u003c/userSettings\u003e\n\u003c/configuration\u003e\n\n5. Impact\n   - Credential theft via local file read\n   - Credential stuffing attacks on other platforms\n   - License key theft for unauthorized activation\n\n6. Steps to Reproduce\n   a. Install and run EZ Game Booster v1.0.0\n   b. Create an account or log in\n   c. Browse to: %LOCALAPPDATA%\\ezgamebooster\\\n      ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\\n   d. Open user.config with Notepad\n   e. Observe plaintext password, email, and licenseKey\n\n7. Remediation\n   Encrypt sensitive data using DPAPI before serialization.\n   Use Windows Credential Manager for credential storage.\n\n8. Author\u0027s Note on Discovery\n   \"I discovered this while uninstalling the software and checking for\n   leftover files. I was not performing any targeted security research\n   at the time \u2014 I simply found my credentials in plaintext by accident.\"\n\n\nBest regards,\nAliReza Chegini - nimaarek\nnim44r3k () gmail com - priv8 () tuta io\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/21"
        },
        {
          "url": "https://ezsystemrepairs.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0103",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21",
            "automated": true,
            "contentSha256": "80227aec16dd9d88bf81836efb7b5f4713a56899de1337982b61deee3e06b5a3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-16T01:47:06Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0103"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-62261 (GCVE-0-2025-62261)

Vulnerability from cvelistv5 – Published: 2025-10-27 21:11 – Updated: 2025-10-28 14:27

Summary

Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user’s password and take over the user’s account.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-28 14:27 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

Liferay CNA under the mitre root

CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details

References

1 reference

URL	Tags
https://liferay.dev/portal/security/known-vulnera…

Impacted products

2 products

Vendor	Product	Version
Liferay	Portal	Affected: 7.4.0 , ≤ 7.4.3.99 (maven)
Liferay	DXP	Affected: 7.3.10 , ≤ 7.3.10-u34 (maven) Affected: 7.4.13 , ≤ 7.4.13-u92 (maven) Affected: 2023.Q3.1 , ≤ 2023.Q3.4 (maven)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-62261",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-28T14:27:39.740720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-28T14:27:47.375Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Portal",
          "vendor": "Liferay",
          "versions": [
            {
              "lessThanOrEqual": "7.4.3.99",
              "status": "affected",
              "version": "7.4.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DXP",
          "vendor": "Liferay",
          "versions": [
            {
              "lessThanOrEqual": "7.3.10-u34",
              "status": "affected",
              "version": "7.3.10",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "7.4.13-u92",
              "status": "affected",
              "version": "7.4.13",
              "versionType": "maven"
            },
            {
              "lessThanOrEqual": "2023.Q3.4",
              "status": "affected",
              "version": "2023.Q3.1",
              "versionType": "maven"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user\u2019s password and take over the user\u2019s account."
            }
          ],
          "value": "Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 34, and older unsupported versions stores password reset tokens in plain text, which allows attackers with access to the database to obtain the token, reset a user\u2019s password and take over the user\u2019s account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-27T21:11:46.893Z",
        "orgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
        "shortName": "Liferay"
      },
      "references": [
        {
          "url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-62261"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8b54e794-c6f0-462e-9faa-c1001a673ac3",
    "assignerShortName": "Liferay",
    "cveId": "CVE-2025-62261",
    "datePublished": "2025-10-27T21:11:46.893Z",
    "dateReserved": "2025-10-09T20:58:53.011Z",
    "dateUpdated": "2025-10-28T14:27:47.375Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-59450 (GCVE-0-2025-59450)

Vulnerability from cvelistv5 – Published: 2025-10-06 00:00 – Updated: 2025-10-06 20:17

Summary

The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-06 20:17 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

3 references

URL	Tags
https://bishopfox.com/blog/advisories
https://shop.yosmart.com/pages/product-support
https://bishopfox.com/blog/how-a-20-smart-device-…

Impacted products

1 product

Vendor	Product	Version
YoSmart	YoLink Smart Hub	Affected: 0382 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59450",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-06T20:17:39.208805Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-06T20:17:46.053Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "YoLink Smart Hub",
          "vendor": "YoSmart",
          "versions": [
            {
              "status": "affected",
              "version": "0382",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The YoSmart YoLink Smart Hub firmware 0382 is unencrypted, and data extracted from it can be used to determine network access credentials."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312 Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T20:01:18.231Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://bishopfox.com/blog/advisories"
        },
        {
          "url": "https://shop.yosmart.com/pages/product-support"
        },
        {
          "url": "https://bishopfox.com/blog/how-a-20-smart-device-gave-me-access-to-your-home"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-59450",
    "datePublished": "2025-10-06T00:00:00.000Z",
    "dateReserved": "2025-09-16T00:00:00.000Z",
    "dateUpdated": "2025-10-06T20:17:46.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-59105 (GCVE-0-2025-59105)

Vulnerability from cvelistv5 – Published: 2026-01-26 10:06 – Updated: 2026-01-26 14:52

Title

Unencrypted Flash Storage in dormakaba access manager

Summary

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.

Severity

7 (High)


                        
                          CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-26 14:52 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

SEC-VLab CNA under the mitre root

CNA scorecard B 81/100 over 22 records in the last 180 days details

References

3 references

URL	Tags
https://r.sec-consult.com/dormakaba	technical-description
https://r.sec-consult.com/dkaccess	third-party-advisory
https://www.dormakabagroup.com/en/security-advisories	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
dormakaba	Access Manager 92xx-k5	Affected: 92xx-K5: All versions
dormakaba	Access Manager 92xx-k7	Affected: 92xx-K7: <BAME 06.00

Credits

Clemens Stockenreitner, SEC Consult Vulnerability Lab Werner Schober, SEC Consult Vulnerability Lab

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59105",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T14:52:09.171238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T14:52:15.466Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Access Manager 92xx-k5",
          "vendor": "dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "92xx-K5: All versions"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Access Manager 92xx-k7",
          "vendor": "dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "92xx-K7: \u003cBAME 06.00"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Clemens Stockenreitner, SEC Consult Vulnerability Lab"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Werner Schober, SEC Consult Vulnerability Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as \"/etc/passwd\", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.\u003cbr\u003e"
            }
          ],
          "value": "With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as \"/etc/passwd\", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37: Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T10:06:02.727Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/dkaccess"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A firmware update to at least BAME 06.00.x RA is recommended. Hardware access and special equipment are required to exploit this vulnerability. In general, the Access Manager should be installed in a secured area and protected by a tamper contact.\u003cbr\u003e"
            }
          ],
          "value": "A firmware update to at least BAME 06.00.x RA is recommended. Hardware access and special equipment are required to exploit this vulnerability. In general, the Access Manager should be installed in a secured area and protected by a tamper contact."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Unencrypted Flash Storage in dormakaba access manager",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2025-59105",
    "datePublished": "2026-01-26T10:06:02.727Z",
    "dateReserved": "2025-09-09T07:53:12.879Z",
    "dateUpdated": "2026-01-26T14:52:15.466Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-59102 (GCVE-0-2025-59102)

Vulnerability from cvelistv5 – Published: 2026-01-26 10:05 – Updated: 2026-01-26 15:15

Title

Secrets Stored in Plaintext in Database in dormakaba access manager

Summary

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can easily get access to the backup functionality by abusing the session management issue (CVE-2025-59101), or by exploiting the weak default password (CVE-2025-59108), or by simply setting a new password without prior authentication via the SOAP API (CVE-2025-59097), it is easily possible to access the sensitive data on the device.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-26 15:15 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

SEC-VLab CNA under the mitre root

CNA scorecard B 81/100 over 22 records in the last 180 days details

References

3 references

URL	Tags
https://r.sec-consult.com/dormakaba	technical-description
https://r.sec-consult.com/dkaccess	third-party-advisory
https://www.dormakabagroup.com/en/security-advisories	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
dormakaba	Access Manager 92xx-k5	Affected: 92xx-K5: <XAMB 04.06.212

Credits

Clemens Stockenreitner, SEC Consult Vulnerability Lab Werner Schober, SEC Consult Vulnerability Lab

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59102",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-26T15:15:01.247591Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-26T15:15:13.733Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Access Manager 92xx-k5",
          "vendor": "dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "92xx-K5: \u003cXAMB 04.06.212"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Clemens Stockenreitner, SEC Consult Vulnerability Lab"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Werner Schober, SEC Consult Vulnerability Lab"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can easily get access to the backup functionality by abusing the session management issue (CVE-2025-59101), or by exploiting the weak default password (CVE-2025-59108), or by simply setting a new password without prior authentication via the SOAP API (CVE-2025-59097), it is easily possible to access the sensitive data on the device.\u003cbr\u003e"
            }
          ],
          "value": "The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with the fact that an attacker can easily get access to the backup functionality by abusing the session management issue (CVE-2025-59101), or by exploiting the weak default password (CVE-2025-59108), or by simply setting a new password without prior authentication via the SOAP API (CVE-2025-59097), it is easily possible to access the sensitive data on the device."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-37",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-37: Retrieve Embedded Sensitive Data"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-26T10:05:31.292Z",
        "orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
        "shortName": "SEC-VLab"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://r.sec-consult.com/dkaccess"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "To secure the Access Manager 92xx, it is highly recommended to update to the latest FW, at least XAMB 04.06.212 RA.\u003cbr\u003e"
            }
          ],
          "value": "To secure the Access Manager 92xx, it is highly recommended to update to the latest FW, at least XAMB 04.06.212 RA."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secrets Stored in Plaintext in Database in dormakaba access manager",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf",
    "assignerShortName": "SEC-VLab",
    "cveId": "CVE-2025-59102",
    "datePublished": "2026-01-26T10:05:31.292Z",
    "dateReserved": "2025-09-09T07:53:12.879Z",
    "dateUpdated": "2026-01-26T15:15:13.733Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-58401 (GCVE-0-2025-58401)

Vulnerability from cvelistv5 – Published: 2025-09-05 04:28 – Updated: 2025-09-05 15:49

Summary

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.

Severity

6.8 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

5.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-05 15:48 UTC

CWE

CWE-312 - Cleartext storage of sensitive information

Assigner

jpcert CNA under the jpcert root

CNA scorecard C 64/100 over 178 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/Pierrad/obsidian-github-copilo…
https://jvn.jp/en/jp/JVN41633999/

Impacted products

1 product

Vendor	Product	Version
Pierre-Adrien Vasseur	Obsidian GitHub Copilot Plugin	Affected: prior to 1.1.7

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-05T15:48:17.433527Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-05T15:49:35.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Obsidian GitHub Copilot Plugin",
          "vendor": "Pierre-Adrien Vasseur",
          "versions": [
            {
              "status": "affected",
              "version": "prior to 1.1.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "Cleartext storage of sensitive information",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T04:28:24.638Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://github.com/Pierrad/obsidian-github-copilot/releases/tag/1.1.7"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN41633999/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-58401",
    "datePublished": "2025-09-05T04:28:24.638Z",
    "dateReserved": "2025-09-01T01:51:22.210Z",
    "dateUpdated": "2025-09-05T15:49:35.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-57806 (GCVE-0-2025-57806)

Vulnerability from cvelistv5 – Published: 2025-09-03 00:47 – Updated: 2025-09-03 15:44

Title

Local Deep Research's API keys are stored in plain text

Summary

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-03 13:47 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information
CWE-522 - Insufficiently Protected Credentials

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7730 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/LearningCircuit/local-deep-res…	x_refsource_CONFIRM
https://github.com/LearningCircuit/local-deep-res…	x_refsource_MISC
http://github.com/LearningCircuit/local-deep-rese…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
LearningCircuit	local-deep-research	Affected: >= 0.2.0, < 1.0.0

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-57806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-03T13:47:32.909510Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-03T15:44:45.651Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "local-deep-research",
          "vendor": "LearningCircuit",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.2.0, \u003c 1.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 stored confidential information, including API keys, in a local SQLite database without encryption. This behavior was not clearly documented outside of the database architecture page. Users were not given the ability to configure the database location, allowing anyone with access to the container or host filesystem to retrieve sensitive data in plaintext by accessing the .db file. This is fixed in version 1.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522: Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-03T00:47:24.262Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-4h8c-qrcq-cv5c"
        },
        {
          "name": "https://github.com/LearningCircuit/local-deep-research/pull/578",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/LearningCircuit/local-deep-research/pull/578"
        },
        {
          "name": "http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/LearningCircuit/local-deep-research/releases/tag/v1.0.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4h8c-qrcq-cv5c",
        "discovery": "UNKNOWN"
      },
      "title": "Local Deep Research\u0027s API keys are stored in plain text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-57806",
    "datePublished": "2025-09-03T00:47:24.262Z",
    "dateReserved": "2025-08-20T14:30:35.009Z",
    "dateUpdated": "2025-09-03T15:44:45.651Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Mitigation

Implementation System Configuration Operation

When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]

Mitigation

Implementation System Configuration Operation

In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

CAPEC-37: Retrieve Embedded Sensitive Data

An attacker examines a target system to find sensitive data that has been embedded within it. This information can reveal confidential contents, such as account numbers or individual keys/credentials that can be used as an intermediate step in a larger attack.

← Back to the CWE list