CVE-2026-90509
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.29%
- CWE
- CWE-798, CWE-259
- Published
- 2026-09-13
- Last modified
- 2026-09-13
Affected products
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
- dromara orion-visor
Weakness type
Related vulnerabilities
- CVE-2026-22769 — Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Thi
- CVE-2026-27507 — Binardat 10G08-0800GSM Network Switch Hard-coded Credentials
- CVE-2026-25803 — 3DP-MANAGER Uses Hard-coded Credentials
- CVE-2026-25202 — The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo
- CVE-2026-24448 — Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administr
- CVE-2026-23647 — Glory RBG-100 Recycler System Hard-coded OS Credentials
- CVE-2025-9497 — Hardcoded Upgrade Decryption Passwords
- CVE-2020-37135 — AMSS++ 4.7 - Backdoor Admin Account