EUVD-2026-120546

INDOTALENT WHMS Asp.Net-Core-Inventory-Order-Management-System before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the...

EUVD-2026-120547

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

EUVD-2026-120548

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-125385

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-125384

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

CVE-2026-125383

INDOTALENT WHMS Asp.Net-Core-Inventory-Order-Management-System before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the...

CVE-2026-125385: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read…

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-125384: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers…

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

CVE-2026-125383: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass…

INDOTALENT WHMS Asp.Net-Core-Inventory-Order-Management-System before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the...

CVE-2026-125385

INDOTALENT WHMS before version 10.20261109 is vulnerable to a path traversal vulnerability (CWE-22). Authenticated users can read arbitrary files by supplying traversal sequences via the documentName and imageName parameters. The root cause is the use of Path.Combine in the GetDocument or GetImag...

CVE-2026-125385 INDOTALENT WHMS before 10.20261109 Path Traversal via FileDocument/GetDocument and FileImage/GetImage

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...

CVE-2026-125383

The INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) software, in versions prior to 10.20261109 , is vulnerable to an authentication bypass due to the use of a hard-coded JWT signing key , issuer, and audience within the appsettings.json file. Unauthenticated remote attackers can ...

CVE-2026-125384

INDOTALENT WHMS versions prior to 10.20261109 are vulnerable to a default credentials vulnerability (CWE-1392 ). The root cause is located in the UserAdminSeeder component, which creates a default administrator account ([email protected] ) with the password 123456 . Because there is no forced passwo...

CVE-2026-125384 INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

CVE-2026-125383 INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass

INDOTALENT WHMS Asp.Net-Core-Inventory-Order-Management-System before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the...

PT-2026-141206

INDOTALENT WHMS Asp.Net-Core-Inventory-Order-Management-System before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the...

PT-2026-141207

INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates [email protected] with password 123456. Attackers can log in with these credentials, which carry every admin role and no...

PT-2026-141208

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without...