CVE-2026-107437 Plaintext Database Password Exposure in GV-E-Map Server V18.2.0A
Attackers can extract plaintext database credentials from the GV-E-Map Server binary or memory, enabling unauthorized database access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107437?
CVE-2026-107437 is a medium-severity vulnerability in GeoVision Inc. GV-E-map Server, published on 12 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.
Weakness: CWE-798
Which versions are affected by CVE-2026-107437?
How do I fix CVE-2026-107437?
No fix has been published for CVE-2026-107437 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107437 being exploited?
There is no known exploitation of CVE-2026-107437 in the wild and no public exploit code.
Sources
Also known as GHSA-rfwp-c2wc-rqp4.