6 matches found
CVE-2026-88893 OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure
OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters,...
CVE-2025-63666
Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...
CVE-2025-63666
The Tenda AC15 router (firmware v15.03.05.18_multi ) is vulnerable to improper access control due to a flawed authentication cookie mechanism. The /login/Auth endpoint issues a cookie in the format password= without HttpOnly , Secure , or SameSite flags. This exposes the password hash to the clie...
CVE-2025-63666
Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...
Tenda AC15 安全漏洞
Tenda AC15 is a wireless router from Tenda China. A security vulnerability exists in Tenda AC15 version v15.03.05.18multi, which stems from an authentication cookie that exposes a password hash and uses a low entropy session identifier, which could lead to session hijacking...
