Windows 95 uses weak encryption for the password list (.pwl) file used when password caching is enabled, which allows local users to gain privileges by decrypting the passwords.
- http://marc.info/?l=bugtraq&m=88536273725787&w=2
- http://marc.info/?l=ntbugtraq&m=88540877601866&w=2
No PoCs found on GitHub currently.