3005
After few trials and errors trying to reproduce the issue , I found that the very first call to passwordrecovered.cgi will give out the credentials no matter what the parameter you send .
 discover vulnerability: found
Please tell me event type and its trigger word from given type options. Output format is "type: trigger".  Option: phishing, data breach, ransom, discover vulnerability, patch vulnerability 
Text: {0} 
Answer:
 discover vulnerability: found