Description
Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data.

This issue affects Menulux Portal: before 20260903211448.
Published: 2026-09-04
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability allows the Menulux Portal to store user passwords in plaintext, enabling an attacker with access to the underlying storage to recover account credentials and immediately impersonate users, thereby compromising confidentiality and potentially availability of services.

Affected Systems

Menulux Portal provided by Menulux Software Inc. is affected by this flaw. All releases before the build identifier 20260903211448 are vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation typically requires local access to the portal's database or file system, where the plaintext credentials can be retrieved. If the database is exposed over a network, remote exploitation may also be possible, but the description does not confirm such exposure.

Generated by OpenCVE AI on September 4, 2026 at 13:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Menulux Portal release that addresses plaintext password storage.
  • After upgrading, reset all user passwords to prevent reuse of compromised credentials.
  • Configure the portal to hash passwords with a strong algorithm such as bcrypt or Argon2, or consult the vendor to enable secure password handling if the current release does not provide this feature.

Generated by OpenCVE AI on September 4, 2026 at 13:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 04 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Menulux
Menulux menulux Portal
Vendors & Products Menulux
Menulux menulux Portal

Fri, 04 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Description Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448.
Title Plaintext Storage of User Credentials in Menulux Software's Menulux Portal
Weaknesses CWE-256
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Menulux Menulux Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published:

Updated: 2026-09-04T13:28:29.935Z

Reserved: 2026-08-06T07:45:31.975Z

Link: CVE-2026-19051

cve-icon Vulnrichment

Updated: 2026-09-04T13:27:54.394Z

cve-icon NVD

Status : Received

Published: 2026-09-04T12:17:18.323

Modified: 2026-09-04T14:17:17.867

Link: CVE-2026-19051

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:20:00Z

Weaknesses
  • CWE-256

    Plaintext Storage of a Password