What’s Vulnerable › Vulnerabilities

CVE-2026-6796: Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-21 · updated 2026-10-26
• Weakness: CWE-312

Description

A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file core/src/main/java/com/publiccms/controller/admin/LoginAdminController.java of the component Failed Login Handler. This manipulation of the argument errorPassword causes cleartext storage in a file or on disk. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• Sanluan PublicCMS: 6.202506.a, 6.202506.b, 6.202506.c, 6.202506.d

References

• https://vuldb.com/submit/794797
• https://vuldb.com/vuln/358490
• https://vuldb.com/vuln/358490/cti

Get alerted when CVE-2026-6796 or the next vulnerability affects your stack