CVE-2019-25605

EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge. Attackers can use adb logcat to extract plaintext passwords logged during the forgot password function, exposing user account credentials.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.27% chance of exploitation in the next 30 days, 19th percentile

Published

2026-03-22

Updated

2026-03-23

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/46933

References

• CVE Record
• NVD entry

Related

• CVE-2019-25604
• CVE-2019-25606
• CVE-2019-25603
• CVE-2019-25607
• CVE-2019-25602
• CVE-2019-25608