EIP-2026-110644

This is a writeup describing an information disclosure vulnerability in PHP Advanced Transfer Manager 1.30, where unauthenticated attackers can retrieve user password hashes via a direct GET request to a predictable endpoint.