Been this way forever. It's fine if you train your users to change passwords and if they're randomly generated but sending the ones you create is where it gets really bad, which it always did by defau

(Quote)

It's the root password you set during the order process for your VPS which is sent in clear text. It's not the account password. And most of the people know, that WHMCS does this. People who use their

(Quote)

(Quote)

If i am not mistaken, WHMCS uses BCRYPT so, the password hashes are useless?

I feel like if something manages to connect to my desk router and then guess my already complicated bitwarden password (prolly easier to just take the RPi lol) then I'd die of a heart attack so my pas

Can confirm password hash in email seems to match my password used at HS.

platform short of them commiting sudoku (read: cPanel).

Change your password and watch the show.

I can confirm the email address, password, IP, and some personal details are correct.

They send me email too, have my real name & address + password.

I do the same thing so I know it's definitely from them too, checked my password manager as well. Here's my password by the way for the billing panel if anyone wants it: DZayiXB2fGt1dJpln5a8 shows abo

(Quote)

Don't know what the password is, I know it's not important to me. Didn't reuse passwords then, I was under pretty constant attack during those days. Nothing of value in the WHMCS account but one or tw

I know the cPanel module's password is hashed based on the salt in the file, would seem odd that the main software wouldn't use the salt while the base software provides a salt for passwords that it s

https://www.ndchost.com/wiki/software/whmcs/client-password-hash

(Quote)

(Quote)

If they gain access to my self-hosted bitwarden vault I'm in far more trouble than passwords.