{"id":"CVE-2015-7902","url":"https://www.cyber-defence.io/tools/cve/CVE-2015-7902","generatedAt":"2026-10-27T19:49:22.425Z","title":"Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.","description":"Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows remote attackers to obtain sensitive information via a series of requests.","published":"2015-10-28T10:59:23.000Z","lastModified":"2026-06-17T00:33:22.000Z","status":"Modified","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"2.0","score":5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N"},"cwe":["CWE-200"],"affected":["infinite automation systems/mango automation"],"epss":{"score":0.03498,"percentile":0.89074,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":false,"firstPublished":"2015-09-28","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":38338,"kind":"exploit","title":"Mango Automation 2.6.0 - Multiple Vulnerabilities","url":"https://www.exploit-db.com/exploits/38338","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/jsp/webapps/38338.txt","file":"exploits/jsp/webapps/38338.txt","published":"2015-09-28","added":"2015-09-28","updated":"2015-09-28","author":"LiquidWorm","type":"webapps","platform":"jsp","port":80,"verified":false,"codes":["CVE-2015-7904","CVE-2015-7903","CVE-2015-7902","CVE-2015-7901","CVE-2015-7900","CVE-2015-6494","CVE-2015-6493","OSVDB-128171","OSVDB-128129","OSVDB-128128","OSVDB-128127","OSVDB-128126","OSVDB-128125","OSVDB-128124","OSVDB-128123"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5256.php"}]},"verdict":{"level":"high","text":"A public exploit is published in Exploit-DB, so the technical barrier is gone even though the severity is medium and EPSS is 3.5%. Treat it as high on anything reachable from the internet."},"changes":[],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02","tags":["Patch","Third Party Advisory","US Government Resource"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02","tags":["Patch","Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-7902","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}