Is there a public PoC exploit available for EUVD-2026-18546?

Yes, a public proof-of-concept exploit is available for EUVD-2026-18546. Prioritise patching immediately. EPSS: 0.0%.

Java EUVD-2026-18546

Q: What is the CVSS score of EUVD-2026-18546?

EUVD-2026-18546 has a CVSS 4.0 base score of 1.1 (Low). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5420 LOW

Use of Hard-coded Cryptographic Key (CWE-321)

2026-04-02 VulDB

GHSA-fw24-mh6x-62vp

Java Information Disclosure Goods Triple App

1.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.1 LOW

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

2.0 (LOW) 1.1 (LOW)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 19:31 euvd

EUVD-2026-18546

Analysis Generated

Apr 02, 2026 - 19:31 vuln.today

CVE Published

Apr 02, 2026 - 19:00 nvd

LOW 2.0

DescriptionCVE.org

A security flaw has been discovered in Shinrays Games Goods Triple App up to 1.200. The affected element is an unknown function of the file jRwTX.java of the component cats.goods.sort.sorting.games. Performing a manipulation of the argument AES_IV/AES_PASSWORD results in use of hard-coded cryptographic key . Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Hard-coded cryptographic keys in Shinrays Games Goods Triple App up to version 1.200 allow local authenticated users to decrypt sensitive data by manipulating AES_IV and AES_PASSWORD parameters in the jRwTX.java component. The vulnerability requires local access and elevated privileges but has low complexity once exploited; publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Technical ContextAI

The vulnerability stems from CWE-321 (Use of Hard-Coded Cryptographic Key), a cryptographic implementation flaw in the cats.goods.sort.sorting.games package. The affected file jRwTX.java contains cryptographic operations that rely on hard-coded AES encryption parameters instead of dynamically generated or securely managed keys. Java applications using embedded symmetric encryption keys are vulnerable to key extraction through reverse engineering or parameter manipulation. The CVSS vector indicates local attack vector (AV:L) with high complexity (AC:H) and low privilege requirements (PR:L), limiting but not eliminating practical exploitation. The confidentiality impact is low (VC:L), meaning attackers can view encrypted data once the hard-coded key is leveraged.

RemediationAI

No vendor-released patch is identified at time of analysis. Immediate action requires upgrading Shinrays Games Goods Triple App beyond version 1.200 if a patched release is available; however, the vendor's non-response to disclosure suggests no official update may exist. As an interim control, restrict local system access to Goods Triple App installations through operating system access controls, disable multi-user access where operationally feasible, or isolate the application to single-user or air-gapped environments. Review and regenerate any sensitive data that may have been encrypted with the hard-coded key. Organizations unable to upgrade should monitor system logs for signs of parameter manipulation attempts (AES_IV/AES_PASSWORD modifications in jRwTX.java execution). Additional details are available in VulDB advisory at https://vuldb.com/vuln/354856.