Threat database

NT OneAPP by NewType Infortech has a vulnerability (CVE-2026-114223) where sensitive information such as plaintext usernames and passwords can be extracted from backup data. This occurs when an unauthenticated local attacker obtains ADB backup access authorization and the user confirms the backup operation. The vulnerability is due to cleartext storage of sensitive information in backup data. It affects versions from 0 up to and including 1.5.22. The CVSS score is 6.7, indicating a medium severity risk.

NT OneAPP by NewType Infortech contains an authentication bypass vulnerability (CWE-287) that allows unauthenticated local attackers to bypass the app's PIN lock via a deep link, gaining access to protected resources of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 6.9, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

NT OneAPP by NewType Infortech has a credential disclosure vulnerability (CVE-2026-114221) where unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView. This can lead to disclosure of the NUP Portal passcode of a logged-in user. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 score is 5.9, indicating a medium severity issue.

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server.

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information.

NUP Portal developed by NewType Infortech has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly upload files. If the attacker manages to bypass the file extension restrictions, they could upload a webshell and execute it on the server side.

EPSS 0.4%VulnerabilityNewType Infortech#cwe-306Germany+7

NUP Pro developed by NewType Infortech has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.

EPSS 0.6%VulnerabilityNewType Infortech#cwe-89Germany+9