CVE-2011-2153: Login.aspx in the SmarterTools SmarterStats 6.0 web server supports URLs containing txtUser and txtPass par...

Security readout for executives and security teams

This CVE describes a credential exposure risk in SmarterTools SmarterStats 6.0. The login page accepted username and password values in the URL, which can leave credentials in browser history, server logs, or Referer logs. The sources do not provide CVSS, confirmed exploitation, or a named fixed version. Exposure is likely limited to environments running SmarterTools SmarterStats 6.0 where users authenticate through URLs containing txtUser and txtPass parameters. Internet-facing administrative or reporting portals would raise business risk because leaked credentials could be reused. Treat this as a credential hygiene and legacy exposure issue. Prioritize if SmarterStats 6.0 is still deployed, internet-facing, or used with privileged accounts. The absence of confirmed exploitation lowers urgency, but leaked credentials can still create downstream compromise risk. Mitigation focus: Check SmarterTools, CERT, and IBM guidance for fixed versions or configuration changes.; Stop using login links that include txtUser or txtPass query parameters.; Rotate credentials that may have appeared in logs, history, or Referer records..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.