CVE-2026-19051

Menulux Portal prior to build 20260903211448 stores a password in plaintext rather than using a hashed or encrypted format (CWE-256). An attacker who has obtained low-privileged access to the portal over the network can retrieve this embedded sensitive data without user interaction. Successful exploitation primarily yields disclosure of the stored password, which could enable further access if the credential is reused elsewhere; the flaw carries high confidentiality impact with limited integrity impact. Any organization running an affected version of Menulux Portal, the web management portal tied to the Menulux restaurant/POS management platform, is exposed. There are no known exploits, no public proof-of-concept, it is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation in the next 30 days.

What to do: Upgrade Menulux Portal to version 20260903211448 or later. Because passwords may have been stored in plaintext, rotate any credentials managed by or stored in the portal after patching, and verify whether those credentials are reused on other systems. Restrict network access to the portal in the interim as a precaution.