Creacast vulnerabilities
We track 3 vulnerabilities in Creacast products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2025.
Latest Creacast vulnerabilities
- 8.8 High severity
Creabox Manager: Improper Control of Generation of Code
Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full
- 8.8 High severity
Creabox Manager: Improper Authentication
Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows.
- 7.5 High severity
Creabox Manager: Exposure of Sensitive Information to an Unauthorized Actor
Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get. When accessed, this endpoint returns internal configuration including the creacodec.lua file, which contains plaintext admin credentials.