PT-2026-25050 · Stalin 143+1 · Website

Rootcrypt · Publicado 2026-03-12 · Atualizado 2026-03-13 · CVE-2026-32138

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions NEXULEAN versions prior to 2.0.0

Description Prior to version 2.0.0, the software exposed Firebase and Web3Forms API keys. An attacker could leverage these exposed keys to interact with backend services without proper authentication. This unauthorized access could potentially compromise application resources and user data.

Recommendations Update to version 2.0.0 or later.

Exploit

Correção

Using Hardcoded Credentials

Improper Access Control

Enumeração de Fraquezas

CWE-798

CWE-284

Identificadores relacionados

CVE-2026-32138

GHSA-R7CR-5WCX-X9WM

Produtos afetados

Website

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32138.json · Exploit
• https://github.com/Stalin-143/website/security/advisories/GHSA-r7cr-5wcx-x9wm · Nota
• https://github.com/Stalin-143/website/releases/tag/v2.0.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-32138 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32138 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2032185053195981202 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2032247335246245930 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032230674669683067 · Publicação no Twitter