CVE-2026-124834

A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.

• CWE-200
• CWE-284

• https://github.com/iomad/iomad/
• https://github.com/iomad/iomad/commit/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b
• https://github.com/iomad/iomad/issues/2831
• https://vuldb.com/cve/CVE-2026-124834
• https://vuldb.com/vuln/433149
• https://vuldb.com/vuln/433149/cti

Published

Nov 9, 2026

Last Modified

Nov 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12479A path traversal vulnerability exists in keras-team/keras ve…6.1
• CVE-2026-1248IBM Business Automation Workflow containers and traditional …4.3
• CVE-2026-12480Keras versions up to and including 3.13.2 are vulnerable to …5.5
• CVE-2026-12481A vulnerability in keras-team/keras version 3.14.0 allows fo…9.8
• CVE-2026-12482A vulnerability in keras-team/keras version 3.12.0 allows an…6.5
• CVE-2026-12483The LearnDash LMS plugin for WordPress is vulnerable to Unre…7.5
• CVE-2026-12484A vulnerability in keras-team/keras version 3.15.0 allows un…7.8
• CVE-2026-12485GV-I/O Box 4E is a smart embedded device with 4 input and 4 …10
• CVE-2026-124850A SQL injection vulnerability exists in a database migration…7.3
• CVE-2026-12486Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12488A memory corruption vulnerability exists in the GV-Cloud fun…6.2
• CVE-2026-12489An incorrect authorization vulnerability in the Data Access …6.5