MSSQL
CVE-2025-59095
Lifecycle Timeline
2DescriptionCVE.org
The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a custom encryption approach rather than a common algorithm used in cryptographic applications. The key itself is static and based on the founder's name of the company. The functionality is for example used to encrypt the user PINs before storing them in the MSSQL database.
AnalysisAI
The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll.
Technical ContextAI
Classified as CWE-798 (Use of Hard-coded Credentials). The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key (cryptoKey) to transform each character of the input string. However, it's important to note that this implementation does not provide strong encryption and should not be considered secure for sensitive data. It's more of a
Affected ProductsAI
The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets
RemediationAI
Monitor vendor advisories for a patch.
An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpo
The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
Privilege escalation in SQL Server 2022 and 2025 stems from insufficient authentication controls on critical functions,
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Mysql Server contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeat
Mysql contains a vulnerability that allows attackers to unauthorized ability to cause a hang or frequently repeatable cr
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affec
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are af
Same weakness CWE-798 – Use of Hard-coded Credentials
View allShare
External POC / Exploit Code
Leaving vuln.today