CVE-2025-0280
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVSS
7.5
Alto
EPSS
0.1%
p1
KEV
—
Exploit Today
0
0-100
Publicado: 3 sept 2025 · Última mod.: 30 sept 2026 · CWE-257
0.1%EPSS · 30 días0.1%
2026-10-042026-10-31
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-287457.5 ALT12.2%
——4Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.22dCVE-2026-103548—0.7%
——0Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.32dCVE-2026-692976.5 MED57.9%
——17Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.38dCVE-2026-801764.7 MED1.2%
——0Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.46dCVE-2026-653097.5 ALT15.8%
——5ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash. This allows an attacker able to read the
credential store or capture network traffic to recover all stored
passwords.66dCVE-2026-225764.3 MED18.2%
——5A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration.6d