AKINSOFT WOLVOX Control Panel leaks database credentials when pulling data in response to a user request. The flaw allows an attacker to receive sensitive information embedded in the outbound payload, effectively exposing credentials that can be used to access the underlying database or other protected resources. This vulnerability is identified as CWE-201, Sensitive Information Exposure.

The issue affects AKINSOFT WOLVOX Control Panel version 26.02.25 and any earlier releases; version 26.02.26 or later includes the fix. The software is distributed by AKIN Software Computer Import-Export Industry and Trade Co. Ltd.

With a CVSS score of 9.8 the vulnerability is considered critical severity, and although EPSS data is not available, the lack of listing in the KEV catalog does not reduce the threat. Attacker access likely requires interaction with the control panel interface or network access to the device hosting the panel, enabling the malicious request that results in credential disclosure. Exposure of database credentials could lead to full compromise of the database, data theft, and further lateral movement within the network.