CVE-2026-22114Medium· 5.3▾ SunlitHTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
msi-imageECP < 4.4.2Update to the latest version.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-22110High· 8.7Missing authentication check on POST/PUT requests
CVE-2026-22109High· 8.4Default WebUI passwords stored in plaintext
CVE-2026-22105High· 8.7Use of default password based on serial number
CVE-2025-12547Low· 3.7A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1
CVE-2025-66204High· 8.1WBCE CMS is a content management system
CVE-2026-122049Low· 3.7Campcodes Bitcoin Wallet System ForgotPasswordController.php random_int excessive authentication