This vulnerability affects the log_login function in the Failed Login Handler component of Sanluan PublicCMS (up to version 6.202506.d). Specifically, manipulation of the errorPassword argument leads to cleartext storage of sensitive information in a file or on disk. The vulnerability can be exploited remotely without user interaction or privileges beyond limited access. The vendor was contacted but did not respond, and no official patch or remediation is currently documented.

The vulnerability allows an attacker to cause sensitive password information related to failed login attempts to be stored in cleartext on disk. This could lead to unauthorized disclosure of passwords if an attacker gains access to the storage location. However, there is no indication of privilege escalation, code execution, or other impacts beyond information disclosure. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to log files and storage locations where failed login data is recorded to limit exposure. Monitoring and controlling file permissions may reduce risk until a patch is released.