CWE-261

Weak Encoding for Password

9 CVEs Avg CVSS 6.9 MITRE
0
CRITICAL
2
HIGH
5
MEDIUM
0
LOW
0
POC
0
KEV

Monthly

CVE-2025-11500 HIGH This Week

An authentication bypass vulnerability in Tinycontrol network devices (tcPDU and LAN Controllers LK3.5, LK3.9, LK4) exposes usernames and encoded passwords for both normal and admin users through unauthenticated HTTP requests to the login page. The vulnerability affects devices running older firmware versions when the secondary authentication mechanism is disabled (default setting), allowing any attacker on the local network to harvest credentials without authentication. With an EPSS score of 0.00043 and no KEV listing, this vulnerability shows low real-world exploitation activity despite its high CVSS score of 8.7.

Information Disclosure Lan Kontroler V3.5 Lk3.9 Tcpdu Lk4
NVD
CVSS 4.0
8.7
EPSS
0.1%
CVE-2026-0809 Monitor

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92.

Information Disclosure
NVD VulDB
EPSS
0.0%
CVE-2024-52334 MEDIUM This Month

A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. [CVSS 5.3 MEDIUM]

Authentication Bypass
NVD
CVSS 3.1
5.3
EPSS
0.0%
CVE-2025-67652 MEDIUM This Month

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. [CVSS 6.1 MEDIUM]

Authentication Bypass
NVD GitHub
CVSS 3.1
6.1
EPSS
0.0%
CVE-2026-22543 Monitor

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials

Information Disclosure
NVD
EPSS
0.0%
CVE-2025-11155 MEDIUM This Month

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Information Disclosure
NVD
CVSS 4.0
6.8
EPSS
0.0%
CVE-2025-26401 MEDIUM This Month

Weak encoding for password vulnerability exists in HMI ViewJet C-more series. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.

Information Disclosure
NVD
CVSS 3.0
6.5
EPSS
0.1%
CVE-2025-2862 MEDIUM This Month

SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.

Information Disclosure Satech Bcu Firmware
NVD
CVSS 4.0
6.9
EPSS
0.1%
CVE-2024-7407 HIGH This Week

Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure
NVD
CVSS 4.0
8.2
EPSS
0.3%
CVE-2025-11500
EPSS 0% CVSS 8.7
HIGH This Week

An authentication bypass vulnerability in Tinycontrol network devices (tcPDU and LAN Controllers LK3.5, LK3.9, LK4) exposes usernames and encoded passwords for both normal and admin users through unauthenticated HTTP requests to the login page. The vulnerability affects devices running older firmware versions when the secondary authentication mechanism is disabled (default setting), allowing any attacker on the local network to harvest credentials without authentication. With an EPSS score of 0.00043 and no KEV listing, this vulnerability shows low real-world exploitation activity despite its high CVSS score of 8.7.

Information Disclosure Lan Kontroler V3.5 Lk3.9 +2
NVD
CVE-2026-0809
EPSS 0%
Monitor

Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92.

Information Disclosure
NVD VulDB
CVE-2024-52334
EPSS 0% CVSS 5.3
MEDIUM This Month

A vulnerability has been identified in syngo.plaza VB30E (All versions < VB30E_HF07). The affected application does not encrypt the passwords properly. [CVSS 5.3 MEDIUM]

Authentication Bypass
NVD
CVE-2025-67652
EPSS 0% CVSS 6.1
MEDIUM This Month

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. [CVSS 6.1 MEDIUM]

Authentication Bypass
NVD GitHub
CVE-2026-22543
EPSS 0%
Monitor

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials

Information Disclosure
NVD
CVE-2025-11155
EPSS 0% CVSS 6.8
MEDIUM This Month

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Information Disclosure
NVD
CVE-2025-26401
EPSS 0% CVSS 6.5
MEDIUM This Month

Weak encoding for password vulnerability exists in HMI ViewJet C-more series. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.

Information Disclosure
NVD
CVE-2025-2862
EPSS 0% CVSS 6.9
MEDIUM This Month

SaTECH BCU, in its firmware version 2.1.3, performs weak password encryption. Rated medium severity (CVSS 6.9), this vulnerability is low attack complexity. No vendor patch available.

Information Disclosure Satech Bcu Firmware
NVD
CVE-2024-7407
EPSS 0% CVSS 8.2
HIGH This Week

Use of a custom password encoding algorithm in Streamsoft Prestiż software allows straightforward decoding of passwords using their encoded forms, which are stored in the application's database. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Information Disclosure
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy