CVE-2018-15681

CVE-2018-15681 affects BTITeam XBTIT 2.5.4, where a user's password hash is rehashed with a predictable salt and stored in a non-HTTPOnly cookie. This critical vulnerability (CVSS 9.8) allows an attacker to steal the cookie and efficiently brute-force the weak hash to recover the cleartext password, leading to full compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness.