EIP-2026-111616

PRE-CVE

qdPM 9.2 - Password Exposure (Unauthenticated)

Title source: legacy

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-111616. PoCs published by Leon Trappett.

AI-analyzed exploit summary This writeup describes an unauthenticated information disclosure vulnerability in qdPM 9.2 where the database connection string and password are exposed via a publicly accessible YAML file. The exploit involves directly accessing the file via a predictable URL path.

Description

qdPM 9.2 - Password Exposure (Unauthenticated)

Exploits (1)

exploitdb WRITEUP

by Leon Trappett · textwebappsphp

https://www.exploit-db.com/exploits/50176

View Code ZIP pw:eip

This writeup describes an unauthenticated information disclosure vulnerability in qdPM 9.2 where the database connection string and password are exposed via a publicly accessible YAML file. The exploit involves directly accessing the file via a predictable URL path.

Classification

Writeup 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: qdPM 9.2

No auth needed

Prerequisites: Network access to the target web server

MITRE ATT&CK

T1592 - Gather Victim Host Information T1082 - System Information Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve

Tracked Since Feb 18, 2026