Database credentials exposed in AKINSOFT WOLVOX Control Panel
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.
Summary
AKINSOFT WOLVOX Control Panel from 26.02.25 before 26.02.26 is affected. Sensitive information is inserted into sent data (CWE-201), which lets attackers pull data from system resources. A remote attacker without privileges or user interaction can obtain database credentials.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AKIN Software Computer Import Export Industry and Trade Ltd. | AKINSOFT WOLVOX Control Panel | 26.02.25 to before 26.02.26 | 26.02.26 | Patch available | CNA |
- AKINSOFT WOLVOX Control Panel VendorAKIN Software Computer Import Export Industry and Trade Ltd. Affected 26.02.25 to before 26.02.26 Fixed in 26.02.26 Patch available CNA
Remediation
Update AKINSOFT WOLVOX Control Panel to version 26.02.26, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA AKINSOFT WOLVOX Control Panel (AKIN Software Computer Import-Export Industry and Trade Co. Ltd.) Fixed in 26.02.26
Timeline
- 2026-10-08 Threatist record created from CVE-2026-92555
References
More AKIN Software Computer Import Export Industry and Trade Ltd. vulnerabilities
- TI-2026-69423 Password reset codes in AKIN MyRezzta can be brute forced CVSS 3.1CRITICAL 9.1
- TI-2026-69422 AKIN OctoCloud authorization bypass exposes restricted functions CVSS 3.1HIGH 8.8
- TI-2026-09209 RCE in Akınsoft's CafePlus CVSS 3.1HIGH 8.8
- TI-2026-13115 Path Traversal in AKIN Software's Wolvox9 ERP CVSS 3.1HIGH 7.5
- TI-2025-09087 IDOR in Akınsoft QRMenu CVSS 3.1HIGH 7.5
- TI-2026-09321 Reflected XSS in Akinsoft's e-Commerce CVSS 3.1MEDIUM 6.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences