CVE-2019-25605
Received Received - Intake
Insecure Logging in EquityPandit 1.0 Exposes User Credentials

Publication date: 2026-03-22

Last updated on: 2026-03-22

Assigner: VulnCheck

Description
EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge. Attackers can use adb logcat to extract plaintext passwords logged during the forgot password function, exposing user account credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-22
Last Modified
2026-03-22
Generated
2026-06-16
AI Q&A
2026-03-22
EPSS Evaluated
2026-06-15
NVD
CVE-2019-25605
EUVD
EUVD-2019-19952
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
equitypandit equitypandit 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-612 The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

[{'type': 'paragraph', 'content': 'EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge (adb).'}, {'type': 'paragraph', 'content': 'Specifically, during the "forgot password" function, the application logs plaintext passwords to the Android developer console (logcat). An attacker with local access can use adb commands to extract these passwords from the device logs.'}, {'type': 'paragraph', 'content': 'This vulnerability arises because the application improperly logs sensitive data, enabling attackers to retrieve user passwords without requiring privileges or user interaction.'}] [1, 2]

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive user credentials, specifically plaintext passwords.

An attacker with local access to the device can exploit this flaw to extract user account passwords from the logs, potentially leading to account compromise.

Because the attack requires only adb access and no special privileges or user interaction, it increases the risk of credential theft on affected devices.

Compliance Impact

I don't know

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by examining the Android device logs for sensitive information such as plaintext passwords being logged during the forgot password function.'}, {'type': 'paragraph', 'content': 'A specific command to detect this vulnerability is using the Android Debug Bridge (adb) to dump the device logs and search for password entries.'}, {'type': 'list_item', 'content': 'Run the command `adb logcat -d` to dump the device logs.'}, {'type': 'list_item', 'content': 'Use a script or manual search to find occurrences of the pattern "password <value>" in the logs.'}, {'type': 'paragraph', 'content': 'For example, a Python script named capture.py can automate this by connecting to the device via adb, dumping the logs, and extracting all logged passwords.'}] [1, 2]

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2019-25605. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart