CVE-2019-25605 EquityPandit 1.0 Insecure Logging Information Disclosure
Attackers can extract plaintext passwords from Android debug logs via ADB, leading to credential theft and account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-25605?
CVE-2019-25605 is a high-severity vulnerability in Play EquityPandit, published on 22 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to capture sensitive user credentials by accessing developer console logs via Android Debug Bridge. Attackers can use adb logcat to extract plaintext passwords logged during the forgot password function, exposing user account credentials.
Weakness: CWE-612
Which versions are affected by CVE-2019-25605?
How do I fix CVE-2019-25605?
No fix has been published for CVE-2019-25605 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-25605 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25605 exists.
Sources
Also known as GHSA-h6ff-pwr6-vvx9.