EIP-2026-111616

This writeup describes an unauthenticated information disclosure vulnerability in qdPM 9.2 where the database connection string and password are exposed via a publicly accessible YAML file. The exploit involves directly accessing the file via a predictable URL path.