EUVD-2026-75404
GHSA-f8xm-42j5-9q25
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth or user interaction; impact limited to low confidentiality (account existence only), no integrity or availability effect.
Primary rating from Vendor (TR-CERT).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting.
This issue affects Website Template: through 10092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Observable response discrepancy in DernekPlus Website Template enables unauthenticated remote account footprinting against all versions through 10092026. By submitting targeted requests and observing differing server responses for valid versus invalid accounts, attackers can enumerate valid usernames or registered member identities without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to the DernekPlus Website Template instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scoring 5.3 is consistent with the nature of the flaw: network-reachable, no privileges or interaction required, but impact limited to low confidentiality (account existence). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor did not respond to TR-CERT's coordinated disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Website Template
View allReflected cross-site scripting in Polen Media Website Template before v2 allows unauthenticated remote attackers to exec
Server-side template injection (SSTI) in Arma Digital Media Inc.'s Website Template product enables remote unauthenticat
Same weakness CWE-204 – Observable Response Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today