CVE-2026-26218

Katalog CVE

CVSS 9.8 · Critical EPSS 0,63%

Kerentanan Use of Hard-coded Credentials pada newbee-mall project newbee-mall. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials may allow unauthenticated attackers to log in as an administrator and gain full administrative control of the application.

Rincian

Terbit di NVD

12 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/newbee-ltd/newbee-mall/issues/119 exploit · issue tracking · advisory vendor
• https://www.vulncheck.com/advisories/newbee-mall-default-seeded-administrator-credentials-allow-account-takeov... advisory pihak ketiga