Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2026-67357

Summary
Assigner-VulnCheck
Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10
Published At-02 Aug, 2026 | 12:15
Updated At-02 Aug, 2026 | 12:19
Rejected At-
Credits

ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:VulnCheck
Assigner Org ID:83251b91-4cc7-4094-a5c7-464a1b83ea10
Published At:02 Aug, 2026 | 12:15
Updated At:02 Aug, 2026 | 12:19
Rejected At:
â–¼CVE Numbering Authority (CNA)
ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

Affected Products
Vendor
ArcadeData
Product
arcadedb
Default Status
unaffected
Versions
Affected
  • From 0 before 26.7.3 (semver)
Unaffected
  • 26.7.3 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-200Exposure of Sensitive Information to an Unauthorized Actor
Type: CWE
CWE ID: CWE-200
Description: Exposure of Sensitive Information to an Unauthorized Actor
Metrics
VersionBase scoreBase severityVector
4.07.7HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.17.5HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 7.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
manus-use
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p9wc-4fhr-78wm
vendor-advisory
https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings
third-party-advisory
Hyperlink: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p9wc-4fhr-78wm
Resource:
vendor-advisory
Hyperlink: https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings
Resource:
third-party-advisory
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:disclosure@vulncheck.com
Published At:02 Aug, 2026 | 13:16
Updated At:02 Aug, 2026 | 13:16

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and achieve full server compromise.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.07.7HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.5HIGH
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 4.0
Base score: 7.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-200Primarydisclosure@vulncheck.com
CWE ID: CWE-200
Type: Primary
Source: disclosure@vulncheck.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p9wc-4fhr-78wmdisclosure@vulncheck.com
N/A
https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settingsdisclosure@vulncheck.com
N/A
Hyperlink: https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-p9wc-4fhr-78wm
Source: disclosure@vulncheck.com
Resource: N/A
Hyperlink: https://www.vulncheck.com/advisories/arcadedb-information-disclosure-via-get-server-settings
Source: disclosure@vulncheck.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

7Records found
CVE-2026-68578
Matching Score-8
Assigner-VulnCheck
ShareView Details
Matching Score-8
Assigner-VulnCheck
CVSS Score-7.7||HIGH
EPSS-Not Assigned
Published-02 Aug, 2026 | 12:15
Updated-02 Aug, 2026 | 13:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ArcadeDB before 26.7.3 Authentication Bypass via MCP Transport

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via the query tool.

Action-Not Available
Vendor-ArcadeData
Product-arcadedb
CWE ID-CWE-306
Missing Authentication for Critical Function
CVE-2026-67343
Matching Score-6
Assigner-VulnCheck
ShareView Details
Matching Score-6
Assigner-VulnCheck
CVSS Score-8.7||HIGH
EPSS-Not Assigned
Published-01 Aug, 2026 | 12:22
Updated-01 Aug, 2026 | 13:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
ArcadeDB before 26.7.2 Cluster Token Disclosure via GET /api/v1/server

ArcadeDB versions before 26.7.2 fail to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.

Action-Not Available
Vendor-ArcadeData
Product-arcadedb
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2021-32624
Matching Score-4
Assigner-GitHub, Inc.
ShareView Details
Matching Score-4
Assigner-GitHub, Inc.
CVSS Score-7.5||HIGH
EPSS-0.86% / 55.08%
||
7 Day CHG~0.00%
Published-24 May, 2021 | 16:55
Updated-03 Aug, 2024 | 23:25
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Private Field data leak

Keystone 5 is an open source CMS platform to build Node.js applications. This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control. This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information. Under some circumstances, field values or field value meta data can be determined, despite the field or list having `read` access control configured. If you use private fields or lists, you may be impacted. No patches exist at this time. There are no workarounds at this time

Action-Not Available
Vendor-keystonejskeystonejs
Product-keystone-5keystone-5
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-23321
Matching Score-4
Assigner-Apache Software Foundation
ShareView Details
Matching Score-4
Assigner-Apache Software Foundation
CVSS Score-7.5||HIGH
EPSS-0.89% / 55.84%
||
7 Day CHG~0.00%
Published-22 Jul, 2024 | 09:24
Updated-13 Feb, 2025 | 18:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache RocketMQ: Unauthorized Exposure of Sensitive Data

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user privileges or listed in the IP whitelist, could potentially acquire the administrator's account and password through specific interfaces. Such an action would grant them full control over RocketMQ, provided they have access to the broker IP address list. To mitigate these security threats, it is strongly advised that users upgrade to version 5.3.0 or newer. Additionally, we recommend users to use RocketMQ ACL 2.0 instead of the original RocketMQ ACL when upgrading to version Apache RocketMQ 5.3.0.

Action-Not Available
Vendor-The Apache Software Foundation
Product-rocketmqApache RocketMQrocketmq
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2023-5256
Matching Score-4
Assigner-Drupal.org
ShareView Details
Matching Score-4
Assigner-Drupal.org
CVSS Score-7.5||HIGH
EPSS-0.69% / 49.38%
||
7 Day CHG~0.00%
Published-28 Sep, 2023 | 18:17
Updated-23 Sep, 2024 | 19:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Drupal core - Critical - Cache poisoning - SA-CORE-2023-006

In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected.

Action-Not Available
Vendor-The Drupal Association
Product-drupalCoredrupal
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2023-52237
Matching Score-4
Assigner-Siemens
ShareView Details
Matching Score-4
Assigner-Siemens
CVSS Score-7.7||HIGH
EPSS-0.44% / 36.46%
||
7 Day CHG~0.00%
Published-09 Jul, 2024 | 12:04
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC, RUGGEDCOM i803, RUGGEDCOM i803NC, RUGGEDCOM M2100, RUGGEDCOM M2100NC, RUGGEDCOM M2200, RUGGEDCOM M2200NC, RUGGEDCOM M969, RUGGEDCOM M969NC, RUGGEDCOM RMC30, RUGGEDCOM RMC30NC, RUGGEDCOM RMC8388 V4.X, RUGGEDCOM RMC8388 V5.X, RUGGEDCOM RMC8388NC V4.X, RUGGEDCOM RMC8388NC V5.X, RUGGEDCOM RP110, RUGGEDCOM RP110NC, RUGGEDCOM RS1600, RUGGEDCOM RS1600F, RUGGEDCOM RS1600FNC, RUGGEDCOM RS1600NC, RUGGEDCOM RS1600T, RUGGEDCOM RS1600TNC, RUGGEDCOM RS400, RUGGEDCOM RS400NC, RUGGEDCOM RS401, RUGGEDCOM RS401NC, RUGGEDCOM RS416, RUGGEDCOM RS416NC, RUGGEDCOM RS416NCv2 V4.X, RUGGEDCOM RS416NCv2 V5.X, RUGGEDCOM RS416P, RUGGEDCOM RS416PNC, RUGGEDCOM RS416PNCv2 V4.X, RUGGEDCOM RS416PNCv2 V5.X, RUGGEDCOM RS416Pv2 V4.X, RUGGEDCOM RS416Pv2 V5.X, RUGGEDCOM RS416v2 V4.X, RUGGEDCOM RS416v2 V5.X, RUGGEDCOM RS8000, RUGGEDCOM RS8000A, RUGGEDCOM RS8000ANC, RUGGEDCOM RS8000H, RUGGEDCOM RS8000HNC, RUGGEDCOM RS8000NC, RUGGEDCOM RS8000T, RUGGEDCOM RS8000TNC, RUGGEDCOM RS900, RUGGEDCOM RS900 (32M) V4.X, RUGGEDCOM RS900 (32M) V5.X, RUGGEDCOM RS900G, RUGGEDCOM RS900G (32M) V4.X, RUGGEDCOM RS900G (32M) V5.X, RUGGEDCOM RS900GNC, RUGGEDCOM RS900GNC(32M) V4.X, RUGGEDCOM RS900GNC(32M) V5.X, RUGGEDCOM RS900GP, RUGGEDCOM RS900GPNC, RUGGEDCOM RS900L, RUGGEDCOM RS900LNC, RUGGEDCOM RS900M-GETS-C01, RUGGEDCOM RS900M-GETS-XX, RUGGEDCOM RS900M-STND-C01, RUGGEDCOM RS900M-STND-XX, RUGGEDCOM RS900MNC-GETS-C01, RUGGEDCOM RS900MNC-GETS-XX, RUGGEDCOM RS900MNC-STND-XX, RUGGEDCOM RS900MNC-STND-XX-C01, RUGGEDCOM RS900NC, RUGGEDCOM RS900NC(32M) V4.X, RUGGEDCOM RS900NC(32M) V5.X, RUGGEDCOM RS900W, RUGGEDCOM RS910, RUGGEDCOM RS910L, RUGGEDCOM RS910LNC, RUGGEDCOM RS910NC, RUGGEDCOM RS910W, RUGGEDCOM RS920L, RUGGEDCOM RS920LNC, RUGGEDCOM RS920W, RUGGEDCOM RS930L, RUGGEDCOM RS930LNC, RUGGEDCOM RS930W, RUGGEDCOM RS940G, RUGGEDCOM RS940GNC, RUGGEDCOM RS969, RUGGEDCOM RS969NC, RUGGEDCOM RSG2100, RUGGEDCOM RSG2100 (32M) V4.X, RUGGEDCOM RSG2100 (32M) V5.X, RUGGEDCOM RSG2100NC, RUGGEDCOM RSG2100NC(32M) V4.X, RUGGEDCOM RSG2100NC(32M) V5.X, RUGGEDCOM RSG2100P, RUGGEDCOM RSG2100P (32M) V4.X, RUGGEDCOM RSG2100P (32M) V5.X, RUGGEDCOM RSG2100PNC, RUGGEDCOM RSG2100PNC (32M) V4.X, RUGGEDCOM RSG2100PNC (32M) V5.X, RUGGEDCOM RSG2200, RUGGEDCOM RSG2200NC, RUGGEDCOM RSG2288 V4.X, RUGGEDCOM RSG2288 V5.X, RUGGEDCOM RSG2288NC V4.X, RUGGEDCOM RSG2288NC V5.X, RUGGEDCOM RSG2300 V4.X, RUGGEDCOM RSG2300 V5.X, RUGGEDCOM RSG2300NC V4.X, RUGGEDCOM RSG2300NC V5.X, RUGGEDCOM RSG2300P V4.X, RUGGEDCOM RSG2300P V5.X, RUGGEDCOM RSG2300PNC V4.X, RUGGEDCOM RSG2300PNC V5.X, RUGGEDCOM RSG2488 V4.X, RUGGEDCOM RSG2488 V5.X, RUGGEDCOM RSG2488NC V4.X, RUGGEDCOM RSG2488NC V5.X, RUGGEDCOM RSG907R, RUGGEDCOM RSG908C, RUGGEDCOM RSG909R, RUGGEDCOM RSG910C, RUGGEDCOM RSG920P V4.X, RUGGEDCOM RSG920P V5.X, RUGGEDCOM RSG920PNC V4.X, RUGGEDCOM RSG920PNC V5.X, RUGGEDCOM RSL910, RUGGEDCOM RSL910NC, RUGGEDCOM RST2228, RUGGEDCOM RST2228P, RUGGEDCOM RST916C, RUGGEDCOM RST916P. The web server of the affected devices allow a low privileged user to access hashes and password salts of all system's users, including admin users. An attacker could use the obtained information to brute force the passwords offline.

Action-Not Available
Vendor-Siemens AG
Product-RUGGEDCOM i801NCRUGGEDCOM RS900MNC-STND-XX-C01RUGGEDCOM RS900G (32M) V5.XRUGGEDCOM RS940GRUGGEDCOM RP110RUGGEDCOM RSG2100RUGGEDCOM RS416Pv2 V4.XRUGGEDCOM i803RUGGEDCOM RSG920PNC V4.XRUGGEDCOM RS910RUGGEDCOM RS920LNCRUGGEDCOM RSG2100NC(32M) V4.XRUGGEDCOM M969RUGGEDCOM RS900G (32M) V4.XRUGGEDCOM RS401RUGGEDCOM RSG2288 V4.XRUGGEDCOM RSG907RRUGGEDCOM RS8000NCRUGGEDCOM RS900MNC-GETS-C01RUGGEDCOM RMC30RUGGEDCOM RST916CRUGGEDCOM RS900GRUGGEDCOM RSG920P V4.XRUGGEDCOM RSL910RUGGEDCOM RS900GNC(32M) V4.XRUGGEDCOM RS900GNCRUGGEDCOM RS940GNCRUGGEDCOM RSG2100NCRUGGEDCOM RSL910NCRUGGEDCOM RS900GPNCRUGGEDCOM RS1600RUGGEDCOM RS1600FRUGGEDCOM RS8000HNCRUGGEDCOM RSG2100 (32M) V4.XRUGGEDCOM RS416PRUGGEDCOM RS8000TRUGGEDCOM RS920LRUGGEDCOM RSG2100NC(32M) V5.XRUGGEDCOM RSG2300 V5.XRUGGEDCOM RSG908CRUGGEDCOM RS900M-GETS-XXRUGGEDCOM M969NCRUGGEDCOM RS416PNCv2 V4.XRUGGEDCOM RST2228RUGGEDCOM RSG2300P V5.XRUGGEDCOM RS1600NCRUGGEDCOM RSG2288NC V5.XRUGGEDCOM RST2228PRUGGEDCOM RSG2200RUGGEDCOM RS416Pv2 V5.XRUGGEDCOM RSG2488 V5.XRUGGEDCOM RS8000ANCRUGGEDCOM RSG2100PNCRUGGEDCOM RS8000TNCRUGGEDCOM RS900LRUGGEDCOM M2200NCRUGGEDCOM M2100RUGGEDCOM RS416NCv2 V5.XRUGGEDCOM RSG2488 V4.XRUGGEDCOM RST916PRUGGEDCOM RS910WRUGGEDCOM RS400NCRUGGEDCOM RS900GPRUGGEDCOM RS900M-STND-C01RUGGEDCOM RS416NCv2 V4.XRUGGEDCOM RSG2488NC V4.XRUGGEDCOM RS969NCRUGGEDCOM RSG2100PNC (32M) V5.XRUGGEDCOM RSG2300NC V4.XRUGGEDCOM RSG909RRUGGEDCOM i800RUGGEDCOM RS900NCRUGGEDCOM RS900GNC(32M) V5.XRUGGEDCOM RS930WRUGGEDCOM M2100NCRUGGEDCOM RS400RUGGEDCOM i800NCRUGGEDCOM RMC30NCRUGGEDCOM M2200RUGGEDCOM RS416v2 V5.XRUGGEDCOM RS900MNC-STND-XXRUGGEDCOM RS8000HRUGGEDCOM RS900M-GETS-C01RUGGEDCOM RS401NCRUGGEDCOM RS1600TRUGGEDCOM RS416RUGGEDCOM RS910LNCRUGGEDCOM i802NCRUGGEDCOM RMC8388NC V5.XRUGGEDCOM RS900NC(32M) V5.XRUGGEDCOM RSG2300 V4.XRUGGEDCOM RSG2300NC V5.XRUGGEDCOM RS900 (32M) V4.XRUGGEDCOM RS920WRUGGEDCOM RS900M-STND-XXRUGGEDCOM RSG2288 V5.XRUGGEDCOM RSG2100 (32M) V5.XRUGGEDCOM i801RUGGEDCOM RMC8388 V4.XRUGGEDCOM RS900NC(32M) V4.XRUGGEDCOM RS930LRUGGEDCOM RSG2288NC V4.XRUGGEDCOM RS1600FNCRUGGEDCOM RS8000ARUGGEDCOM RSG2200NCRUGGEDCOM RSG920P V5.XRUGGEDCOM RMC8388 V5.XRUGGEDCOM RS930LNCRUGGEDCOM RS8000RUGGEDCOM RSG2100PNC (32M) V4.XRUGGEDCOM i802RUGGEDCOM RS416PNCRUGGEDCOM RS900WRUGGEDCOM RS900LNCRUGGEDCOM RSG2100PRUGGEDCOM RSG2100P (32M) V4.XRUGGEDCOM RS910NCRUGGEDCOM RSG2300PNC V4.XRUGGEDCOM RSG2300PNC V5.XRUGGEDCOM RS416PNCv2 V5.XRUGGEDCOM RS969RUGGEDCOM RSG920PNC V5.XRUGGEDCOM RS900 (32M) V5.XRUGGEDCOM RS416NCRUGGEDCOM RP110NCRUGGEDCOM RS1600TNCRUGGEDCOM RS900MNC-GETS-XXRUGGEDCOM RSG2488NC V5.XRUGGEDCOM RS416v2 V4.XRUGGEDCOM RS910LRUGGEDCOM RSG910CRUGGEDCOM RSG2300P V4.XRUGGEDCOM RSG2100P (32M) V5.XRUGGEDCOM RS900RUGGEDCOM RMC8388NC V4.XRUGGEDCOM i803NCruggedcom_rs400ruggedcom_rs900gruggedcom_rs920lncruggedcom_rs8000hncruggedcom_rsg2100ncruggedcom_rsl910ncruggedcom_rsg907rruggedcom_rs940gncruggedcom_rst2228ruggedcom_rs416pruggedcom_rmc30ruggedcom_rsg2100pncruggedcom_rs1600fruggedcom_rs910ncruggedcom_rs416pncruggedcom_rs401ncruggedcom_rs900gpruggedcom_rs1600ruggedcom_rs8000ancruggedcom_rs401ruggedcom_rsg2100pruggedcom_rsl910ruggedcom_rs1600ncruggedcom_rs969ncruggedcom_rs400ncruggedcom_rs8000ncruggedcom_rs930lruggedcom_rs920wruggedcom_m2200ruggedcom_rs900lncruggedcom_rs910lruggedcom_i800ncruggedcom_rp110ncruggedcom_rs8000hruggedcom_rsg2200ruggedcom_rs900wruggedcom_m2100ncruggedcom_rs1600tncruggedcom_rs900ncruggedcom_rsg2200ncruggedcom_m969ncruggedcom_rs416ncruggedcom_m2100ruggedcom_rp110ruggedcom_rs940gruggedcom_rs8000aruggedcom_rs8000ruggedcom_rsg910cruggedcom_m2200ncruggedcom_rs1600fncruggedcom_rst916cruggedcom_i803ruggedcom_rs920lruggedcom_i802ruggedcom_rs910lncruggedcom_rs910wruggedcom_rs900ruggedcom_i802ncruggedcom_i803ncruggedcom_rs969ruggedcom_m969ruggedcom_rs930wruggedcom_rs1600truggedcom_i800ruggedcom_rsg908cruggedcom_rs910ruggedcom_rs416ruggedcom_rst916pruggedcom_rs8000truggedcom_rs900gpncruggedcom_i801ruggedcom_rs900lruggedcom_rst2228pruggedcom_i801ncruggedcom_rs8000tncruggedcom_rsg2100ruggedcom_rsg909rruggedcom_rmc30ncruggedcom_rs900gncruggedcom_rs930lnc
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2023-2916
Matching Score-4
Assigner-Wordfence
ShareView Details
Matching Score-4
Assigner-Wordfence
CVSS Score-7.5||HIGH
EPSS-20.89% / 97.31%
||
7 Day CHG~0.00%
Published-15 Aug, 2023 | 08:32
Updated-08 Apr, 2026 | 19:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

Action-Not Available
Vendor-revmakxrevmakx
Product-infinitewp_clientInfiniteWP Client
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CWE ID-CWE-668
Exposure of Resource to Wrong Sphere
Details not found