CVE-2026-49191

Published: Giu 04, 2026 Last Modified: Giu 04, 2026

ExploitDB:

Other exploit source:

Google Dorks:

CRITICAL 9,3

Source: 8fc372e3-d9c5-46e4-9410-38469745c639

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: none

Confidentiality: N/A

Integrity: N/A

Availability: N/A

AI Translation Available

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

287

Draft

Abstraction: Class Structure: Simple

Security Scopes Affected:

Integrity Confidentiality Availability Access Control

Potential Impacts:

Read Application Data Gain Privileges Or Assume Identity Execute Unauthorized Code Or Commands

Technologies: Not Technology-Specific, Web Based, ICS/OT

Likelihood of Exploit: High