CVE-2026-26049: Insufficiently Protected Credentials

The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, screenshots, or browser form...

Malicious Package

s3asy is a malicious package. The package contains code that when executed in the browser, would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

b2ePms 1.0 - Authentication Bypass

b2ePMS 1.0 Authentication Bypass Vulnerability Discovered by: Jean Pascal Pereira Vendor Information: "b2ePMS stands for Browser to Email Phone Message System. It is intended to replace the standard paper/carbon phone message slips commonly used in offices, with the capability of sending the...