CVE-2026-11347

Name of the Vulnerable Software and Affected Versions linqi (affected versions not specified)

Description The application contains hardcoded cryptographic keys and employs a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors (IVs) for AES/CBC encryption. This implementation makes known-plaintext attacks feasible, where an attacker can deduce the plaintext by comparing it with the ciphertext. An attacker with local access can decrypt sensitive obfuscated strings, such as ConnectionString values containing database credentials located in the appsettings.json file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.