CVE-2026-6574 - osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials

Back Back to CVE browser

MEDIUM

osuuu LightPicture API Upload Endpoint lp.sql hard-coded credentials

Published Apr 19, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.47%

Description

A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded credentials. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Osuuu Product LightPicture Default
n/a
- Version
  1.2.0
  Status
  affected
  Constraints
  -
- Version
  1.2.1
  Status
  affected
  Constraints
  -
- Version
  1.2.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Osuuu

LightPicture

n/a

Version	Status	Constraints
1.2.0	affected	-
1.2.1	affected	-
1.2.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-259

CWE-798

Hard-coded Credentials

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23705
Advisory
https://vuldb.com/submit/790000
third-party-advisory
https://vuldb.com/vuln/358209
vdb-entrytechnical-description
https://vuldb.com/vuln/358209/cti
signaturepermissions-required
https://vulnplus-note.wetolink.com/share/VhoNkMja5u7A
broken-linkexploit

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23705		Advisory
https://vuldb.com/submit/790000		third-party-advisory
https://vuldb.com/vuln/358209		vdb-entrytechnical-description
https://vuldb.com/vuln/358209/cti		signaturepermissions-required
https://vulnplus-note.wetolink.com/share/VhoNkMja5u7A		broken-linkexploit