{"id":"CVE-2025-60791","aliases":["EUVD-2025-36218","GHSA-jfx7-932x-94fg"],"status":"published","title":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in...","description":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00109,"percentile":0.0122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-316"],"published":"2025-10-27T00:00:00Z","modified":"2026-11-05T21:10:00Z","exploits":[{"source":"pocgithub","id":"Smarttfoxx/CVE-2025-60791","title":"Smarttfoxx/CVE-2025-60791","date":"2025-10-22","url":"https://github.com/Smarttfoxx/CVE-2025-60791"}],"references":[{"url":"https://sourceforge.net/projects/easyworkaccounting/"},{"url":"https://packetstorm.news/files/id/210832"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-60791"},{"url":"https://sourceforge.net/projects/easyworkaccounting"},{"url":"https://github.com/advisories/GHSA-jfx7-932x-94fg"}],"sources":{"cve":[{"id":"CVE-2025-60791","description":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.","status":"published","published":"2025-10-27T00:00:00Z","modified":"2025-10-27T19:56:13.426Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-316"],"updated_at":"2026-11-02T14:32:40.072186Z"}],"euvd":[{"id":"EUVD-2025-36218","description":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.","status":"published","published":"2025-10-27T00:00:00Z","modified":"2025-10-27T19:56:13Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:37.020896Z"}],"ghsa":[{"id":"GHSA-jfx7-932x-94fg","title":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in...","description":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.","status":"published","published":"2025-10-27T18:31:11Z","modified":"2025-10-27T21:31:29Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-316"],"updated_at":"2026-11-02T15:04:13.776182Z"}],"nvd":[{"id":"CVE-2025-60791","description":"Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid device-bound license keys in process memory after a failed activation attempt. The keys can be obtained by attaching a debugger or analyzing the process/memory dump and then they can be used to activate the software on the same machine without purchasing.","status":"published","published":"2025-10-27T16:15:42.51Z","modified":"2026-11-05T21:10:00.183Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-316"],"updated_at":"2026-11-05T23:57:15.690201Z"}]}}