Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/saltbo/zpan

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 2.9GoPublished

    ZPan Uses Hard-Coded Password

    CVE-2025-7453 · GHSA-2hfh-94w5-wxvf

    Affected
    • Go github.com/saltbo/zpan < 1.6.6
    Fixed in
    1.6.6· Vendor fix available
    Issue
    A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use of hard-coded password. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

    Recommended action: Upgrade to 1.6.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →