What is the CVSS score of EUVD-2026-56785?

EUVD-2026-56785 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of ishankportfolio are affected by EUVD-2026-56785?

ishankportfolio versions prior to 1.0.1 expose customer contact form submissions containing names, email addresses, phone numbers, and messages through database credentials embedded in client-side…. A patch is available.

How to fix or mitigate EUVD-2026-56785?

Within 24 hours, identify all applications using ishankportfolio and document current versions deployed. Within 7 days, upgrade to version 1.0.1 or later on all instances and verify client-side code no longer contains database credentials. Within 30 days, audit database access logs for unauthorized queries, implement restrictive database access controls limiting form submission access to authenticated application services only, and notify customers if evidence of unauthorized access to form submissions is discovered.

ishankportfolio EUVD-2026-56785

| CVE-2026-48771 HIGH

Information Exposure (CWE-200)

2026-08-11 security-advisories@github.com

Information Disclosure

8.2

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Credentials embedded in public client-side JS grant network-reachable unauthenticated database access; no confidentiality scope beyond stored PII, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 19:35 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 18:17 cve.org

HIGH 8.2

DescriptionCVE.org

ishankportfolio is a portfolio website. Prior to version 1.0.1, contact form submissions could potentially be exposed due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorised users to read, modify, or abuse stored form submission data. This could impact personally identifiable information (PII) submitted through the website contact form, including names, email addresses, phone numbers, and messages. The issue has been patched in version 1.0.1. Users unable to upgrade immediately can reduce risk by disabling public read/write database access, rotating exposed API keys, restricting database policies to authenticated requests only, moving sensitive operations to secure backend/serverless functions, and/or monitoring database activity logs for suspicious access.

AnalysisAI

ishankportfolio exposes contact form submissions containing personally identifiable information (PII) due to client-side database credentials being publicly accessible and database access rules being insufficiently restrictive. Versions prior to 1.0.1 are affected, and the CVSS vector (PR:N, AV:N) confirms unauthenticated remote access is possible without any special preconditions. Any actor who discovers the exposed API keys embedded in client-side code can read or modify stored form submissions - including names, email addresses, phone numbers, and messages - directly against the database. No public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability class is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), arising from a client-side database integration pattern - most likely Firebase Realtime Database or Firestore, or a similar Backend-as-a-Service (BaaS) platform - where the database API keys are embedded in front-end JavaScript and database security rules permit unauthenticated read and write operations. This anti-pattern is common in portfolio and hobby projects where developers embed credentials in client bundles and fail to configure rule-based access control (e.g., Firebase Rules requiring auth != null). The EUVD and GitHub advisory confirm the affected package as ishankportfolio versions below 1.0.1.

RemediationAI

The vendor-released patch is version 1.0.1; operators should upgrade immediately. For those unable to upgrade, the advisory recommends several concrete compensating controls: disable public read/write database access rules to require authentication for all database operations; rotate any exposed API keys or database credentials immediately since they may already be harvested from client-side code; restrict database security rules to authenticated requests only (e.g., in Firebase Rules: allow read, write: if request.auth != null); move sensitive form-handling logic to secure backend or serverless functions so credentials are never exposed to the client; and enable database activity log monitoring to detect unauthorized read or write attempts already in progress. Note that rotating API keys alone is insufficient if database access rules remain permissive, as new keys will also be exposed in the client bundle. Advisory: https://github.com/Ishankjha740/ishankportfolio/security/advisories/GHSA-44fc-h2mc-cw9g.