Answer in brief
CVE-2026-124834 records a Medium severity (CVSS 6.3) vulnerability in iomad Password Field company_user.php store_temporary_password information disclosure. The current sources do not mark it as known exploited. The current feed maps n/a/iomad (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps n/a/iomad (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| n/a/iomadgeneric | 4.5.0 || 4.5.1 || 4.5.2 || 4.5.3 || 4.5.4 || 4.5.5 || 4.5.6 || 4.5.7 || 4.5.8 || 4.5.9 || 4.5.10 || 4.5.11 || 4.5.12 || 4.5.13 || 4.5.14 || 4.5.15 || 5.0.0 || 5.0.1 || 5.0.2 || 5.0.3 || 5.0.4 || 5.0.5 || 5.0.6 || 5.0.7 || 5.0.8 || 5.0.9 || 5.0.10 || 5.0.11 || 5.1.0 || 5.1.1 || 5.1.2 || 5.1.3 || 5.1.4 || 5.1.5 || 5.1.6 || 5.1.7 || 5.1.8 || 5.2.0 || 5.2.1 || 5.2.2 || 5.2.3 || 5.2.4 | Not reported |
Published upstream
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 9, 2026
A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
Quoted source text, attributed separately from HOL analysis.