CVE-2018-15681

An issue was discovered in BTITeam XBTIT 2.5.4. When a user logs in, their password hash is rehashed using a predictable salt and stored in the "pass" cookie, which is not flagged as HTTPOnly. Due to the weak and predictable salt that is in place, an attacker who successfully steals this cookie can efficiently brute-force it to retrieve the user's cleartext password.

• CWE-732
• CWE-916

• https://rastating.github.io/xbtit-multiple-vulnerabilities/Exploit, Mitigation, Third Party Advisory
• https://rastating.github.io/xbtit-multiple-vulnerabilities/Exploit, Mitigation, Third Party Advisory

Published

Sep 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15676An issue was discovered in BTITeam XBTIT. By using String.re…
• CVE-2018-15677The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT…
• CVE-2018-15678An issue was discovered in BTITeam XBTIT 2.5.4. The "act" pa…
• CVE-2018-15679An issue was discovered in BTITeam XBTIT 2.5.4. The "keyword…
• CVE-2018-1568IBM QRadar SIEM 7.2 and 7.3 allows web pages to be stored lo…4
• CVE-2018-15680An issue was discovered in BTITeam XBTIT 2.5.4. The hashed p…
• CVE-2018-15682An issue was discovered in BTITeam XBTIT. Due to a lack of c…
• CVE-2018-15683An issue was discovered in BTITeam XBTIT. The "returnto" par…
• CVE-2018-15684An issue was discovered in BTITeam XBTIT. PHP error logs are…
• CVE-2018-15685GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in c…
• CVE-2018-15686A vulnerability in unit_deserialize of systemd allows an att…7.8
• CVE-2018-15687A race condition in chown_one() of systemd allows an attacke…7