CVE-2026-6796
Cleartext Password Storage in Sanluan PublicCMS Failed Login Handler
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sanluan | publiccms | to 6.202506.d (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
| CWE-313 | The product stores sensitive information in cleartext in a file, or on disk. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the cleartext storage of passwords due to manipulation of the errorPassword argument in the Sanluan PublicCMS Failed Login Handler. Storing passwords in cleartext can lead to unauthorized access to sensitive information if the storage is compromised.
Such cleartext storage of sensitive authentication data may violate common data protection standards and regulations like GDPR and HIPAA, which require appropriate protection of personal and sensitive data, including encryption or secure handling of authentication credentials.
Therefore, this vulnerability could negatively impact compliance with these standards by failing to adequately protect user credentials.
Can you explain this vulnerability to me?
This vulnerability exists in Sanluan PublicCMS up to version 6.202506.d, specifically in the log_login function of the Failed Login Handler component. It involves manipulation of the argument errorPassword, which causes passwords to be stored in cleartext either in a file or on disk. The vulnerability can be exploited remotely.
How can this vulnerability impact me? :
The vulnerability can lead to sensitive password information being stored in cleartext, which increases the risk of unauthorized access if an attacker gains access to the storage location. Since the attack can be initiated remotely, it poses a risk of exposing user credentials without requiring physical access.