PT-2026-25618 · Index Conferences & Exhibitions Organization · Ywf Bpof Apgcs App

Fxizenta + 1 · Publicado 2026-03-16 · Atualizado 2026-03-16 · CVE-2026-4219

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App versions up to 1.0.2

Description A flaw exists in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App on Android. The issue affects an unknown functionality within the com/index/event/BuildConfig.java file of the ae.index.apgcs component. Manipulation of the ACCESS KEY/HASH KEY argument can lead to the disclosure of hard-coded credentials. Exploitation is limited to local execution. The exploit has been published. The vendor was contacted regarding this issue but did not respond.

Recommendations Versions prior to 1.0.2 should be updated. As a temporary workaround, consider restricting access to the BuildConfig.java file to minimize the risk of exploitation.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

CWE-259

Identificadores relacionados

CVE-2026-4219

Produtos afetados

Ywf Bpof Apgcs App

Referências · 9

• 🔥 https://notion.so/Authorization-Credentials-in-ae-index-apgcs-Lead-to-Exposure-of-Backend-Secrets-3172de3f97fb8040bc30c5519a742251?source=copy_link · Exploit
• 🔥 https://notion.so/Authorization-Credentials-in-ae-index-apgcs-Lead-to-Exposure-of-Backend-Secrets-3172de3f97fb8040bc30c5519a742251 · Exploit
• https://vuldb.com/?ctiid.351143 · Nota
• https://vuldb.com/?submit.770513 · Nota
• https://vuldb.com/?id.351143 · Nota
• https://twitter.com/CVEnew/status/2033583706573840576 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4219 · Nota de Segurança
• https://t.me/CVEtracker/47533 · Publicação no Telegram
• https://twitter.com/infoflowcloud/status/2033585755050606654 · Publicação no Twitter