CVE-2026-111993

Received Received - Intake

Cleartext Password Storage in Soarkey StudentManagement

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-111993

Affected Vendors & Products

Vendor	Product	Version / Range
Soarkey	StudentManagement	e08f7f1d5015af407aa4cca0ada3dea189b4937e

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-310	Cryptographic Issues

Attack-Flow Graph

Executive Summary

This vulnerability is in Soarkey StudentManagement software where the UserDao.login function in AdminDao.java stores passwords in cleartext. This means sensitive login credentials are saved without encryption, making them easily readable if accessed.

Detection Guidance

This vulnerability involves cleartext storage of sensitive information in Soarkey StudentManagement. To detect it, inspect the AdminDao.java file for the UserDao.login function and check if passwords are stored without encryption. Search for plaintext password handling in code repositories or logs.

Impact Analysis

If exploited, attackers with local access could retrieve stored passwords, leading to unauthorized account access. This could compromise student or administrative data, depending on user permissions.

Compliance Impact

Storing passwords in cleartext violates data protection principles in GDPR and HIPAA, which require encryption of sensitive data. Non-compliance may result in legal penalties and loss of trust.

Mitigation Strategies

Immediately update Soarkey StudentManagement to the latest version if available. If no update exists, disable the UserDao.login function or restrict local access to the system. Review logs for unauthorized access attempts and ensure sensitive data is encrypted at rest.

Hi! I’m here to help you understand CVE-2026-111993. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70