PT-2026-33100 · Slah · Slah

Published 2026-04-15 · Updated 2026-04-17 · CVE-2026-30994

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Slah versions prior to 1.5.1

Description Incorrect access control in the 'config.php' component allows unauthenticated attackers to access sensitive information, including active session credentials.

Recommendations Update to a version newer than 1.5.0. Restrict access to the 'config.php' component to minimize the risk of exploitation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-30994

Affected Products

Slah

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-30994 · Security Note
• https://cve.joaopaulodeoliveira.dev/cve.php/published/CVE-2026-30994 · Note
• https://twitter.com/CVEnew/status/2045112924663099524 · Twitter Post
• https://cve.joaopaulodeoliveira.dev/cve.php/reserved/slah-informatica-sensitive-data-exposure · Note