# CWE-1393.

Every Advisory and CVE whose sources give the weakness CWE-1393, newest first.

## Records, newest first

- [Default Administrator Password Change Not Enforced in Axxon One Web Client](https://agentprime.io/advisories/CVE-2026-121022.md)
  `CVE-2026-121022` · CVE record: AxxonSoft Axxon One · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-1393
- [diem-project diem dmDataLoad.php default password](https://agentprime.io/advisories/CVE-2026-112030.md)
  `CVE-2026-112030` · CVE record: diem-project diem · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: CWE-1393
- [Lenovo Smart Camera C33: A potential vulnerability was reported in Lenovo Smart Camera C33…](https://agentprime.io/advisories/CVE-2026-16755.md)
  `CVE-2026-16755` · CVE record: Lenovo Smart Camera C33 and 4 more · CVSS 6.0 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-1393
- [Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise](https://agentprime.io/advisories/GHSA-pqxw-g93w-hj9x.md)
  `GHSA-pqxw-g93w-hj9x`, `CVE-2026-114087` · npm `trigger.dev`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: CWE-653, CWE-1393
- [XING CPTrans-ME-X contains a Use of Default Password (CWE-1393).](https://agentprime.io/advisories/CVE-2026-69657.md)
  `CVE-2026-69657` · CVE record: Xing Inc. XING CPTrans-ME-X · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-1393
- [sambitraj Student-Management-System aca.sql default password](https://agentprime.io/advisories/CVE-2026-82698.md)
  `CVE-2026-82698` · CVE record: sambitraj Student-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 31 Aug 2026 · Tags: CWE-1393
- [Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-19851.md)
  `CVE-2026-19851` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 7.7 High · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-1393
- [VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16504.md)
  `CVE-2026-16504` · CVE record: VPS.org Zulip template · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: Hard-coded credentials, CWE-1188, CWE-1393
- [VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-16503.md)
  `CVE-2026-16503` · CVE record: VPS.org Supabase template · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2026 · Tags: CWE-1188, CWE-1327, CWE-1393
- [Navigator NCS and MCP System Accounts with Default Passwords](https://agentprime.io/advisories/CVE-2026-5269.md)
  `CVE-2026-5269` · CVE record: CIENA Navigator NCS and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: CWE-1393
- [Vantage6: Set admin user and password from environment or configuration](https://agentprime.io/advisories/GHSA-fgmc-2hqj-86v4.md)
  `GHSA-fgmc-2hqj-86v4`, `CVE-2026-54445`, `PYSEC-2026-3400` · PyPI `vantage6`: affected `<5.0.0`, fixed in `5.0.0` · CVSS 6.9 Medium · Not analysed yet · Published 5 Jun 2026 · Tags: CWE-204, CWE-1393
- [Hardcoded default Password for Service Account](https://agentprime.io/advisories/CVE-2026-35075.md)
  `CVE-2026-35075` · CVE record: MBS Single-A and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2026 · Tags: CWE-1393
- [Default credentials for internal DB](https://agentprime.io/advisories/CVE-2026-8672.md)
  `CVE-2026-8672` · CVE record: syslink software AG Avantra · CVSS 5.1 Medium · Not analysed yet · Published 22 May 2026 · Tags: CWE-1393
- [JSI Virtual Lightweight Collector: Default password is not required to be changed which allows unauthorized high-privileged access](https://agentprime.io/advisories/CVE-2026-33784.md)
  `CVE-2026-33784` · CVE record: Juniper Networks JSI LWC · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-1393
- [IBM WebSphere Application Server Liberty could provide weaker than expected security](https://agentprime.io/advisories/CVE-2025-14917.md)
  `CVE-2025-14917` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 6.7 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-1393
- [Harbor allows the use of the default password for web UI login](https://agentprime.io/advisories/GHSA-hj7x-hmf2-hc2p.md)
  `GHSA-hj7x-hmf2-hc2p`, `BIT-harbor-2026-4404`, `CVE-2026-4404`, `GO-2026-4845` · Go `github.com/goharbor/harbor`: affected `<=2.15.0`, no fixed version yet · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2026 · Tags: Hard-coded credentials, CWE-1393
- [Weak credentials in Eclipse Foundation Eclipse OpenMQ](https://agentprime.io/advisories/CVE-2026-22886.md)
  `CVE-2026-22886` · CVE record: Eclipse Foundation Eclipse OpenMQ · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Hard-coded credentials, CWE-1392, CWE-1393
- [feiyuchuixue sz-boot-parent Password Reset password default password](https://agentprime.io/advisories/CVE-2026-3186.md)
  `CVE-2026-3186` · CVE record: feiyuchuixue sz-boot-parent · CVSS 5.3 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-1393
- [MLflow Use of Default Password Authentication Bypass Vulnerability](https://agentprime.io/advisories/GHSA-gq3w-7jj3-x7gr.md)
  `GHSA-gq3w-7jj3-x7gr`, `CVE-2026-2635`, `PYSEC-2026-421` · PyPI `mlflow`: affected `<3.8.0rc0`, fixed in `3.8.0rc0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2026 · Tags: Hard-coded credentials, CWE-1393
- [Tenda W30E V2 Hardcoded Default Password for Built-in Account](https://agentprime.io/advisories/CVE-2026-24429.md)
  `CVE-2026-24429` · CVE record: Shenzhen Tenda Technology Co., Ltd. W30E V2 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jan 2026 · Tags: CWE-1393
- [No password set for administrative account in Vivotek IP7137 cameras](https://agentprime.io/advisories/CVE-2025-66050.md)
  `CVE-2025-66050` · CVE record: Vivotek IP7137 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jan 2026 · Tags: CWE-1393
- [Liferay Portal Uses Default Password](https://agentprime.io/advisories/GHSA-43xf-59vr-g4f2.md)
  `GHSA-43xf-59vr-g4f2`, `CVE-2025-43799` · Maven `com.liferay.portal:release.portal.bom`: affected `>=7.4.0, <7.4.3.112`, fixed in `7.4.3.112` · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: CWE-1393
- [Cudy WR1200EA shadow default password](https://agentprime.io/advisories/CVE-2025-9589.md)
  `CVE-2025-9589` · CVE record: Cudy WR1200EA · CVSS 2.0 Low · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-1393
- [NeuVector admin account has insecure default password](https://agentprime.io/advisories/GHSA-8pxw-9c75-6w56.md)
  `GHSA-8pxw-9c75-6w56`, `CVE-2025-8077`, `GO-2025-3918` · Go `github.com/neuvector/neuvector`: affected `<0.0.0-20250825191744-da1a462074c3`, fixed in `0.0.0-20250825191744-da1a462074c3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-1393
- [Poly Clariti Manager - Multiple Security Vulnerabilities](https://agentprime.io/advisories/CVE-2025-43021.md)
  `CVE-2025-43021` · CVE record: HP Inc. Poly Clariti Manager · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-1393
- [70mai A510 Use of Default Password Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-2766.md)
  `CVE-2025-2766` · CVE record: 70mai A510 · CVSS 8.8 High · Not analysed yet · Published 6 Jun 2025 · Tags: CWE-1393
- [ZKTeco BioTime default password](https://agentprime.io/advisories/CVE-2024-13966.md)
  `CVE-2024-13966` · CVE record: ZKTeco BioTime · CVSS 6.9 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-1393
- [Dell PowerScale OneFS: Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0…](https://agentprime.io/advisories/CVE-2025-27690.md)
  `CVE-2025-27690` · CVE record: Dell PowerScale OneFS · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2025 · Tags: CWE-1393
- [Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.](https://agentprime.io/advisories/CVE-2025-22938.md)
  `CVE-2025-22938` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-1393
- [Netis WF-2404 passwd default password](https://agentprime.io/advisories/CVE-2025-2921.md)
  `CVE-2025-2921` · CVE record: Netis WF-2404 · CVSS 5.4 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-1393
- [Dell SmartFabric OS10 Software: Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6.x, 10.6.0.x…](https://agentprime.io/advisories/CVE-2024-49559.md)
  `CVE-2024-49559` · CVE record: Dell SmartFabric OS10 Software · CVSS 8.8 High · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-1393
- [IROAD Dash Cam FX2 Device Registration default password](https://agentprime.io/advisories/CVE-2025-2347.md)
  `CVE-2025-2347` · CVE record: IROAD Dash Cam FX2 · CVSS 5.3 Medium · Not analysed yet · Published 16 Mar 2025 · Tags: CWE-1393
- [An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova.](https://agentprime.io/advisories/CVE-2025-26701.md)
  `CVE-2025-26701` · CVE record: Percona Monitoring and Management · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2025 · Tags: CWE-1393
- [i-Drive i11/i12 WiFi default password](https://agentprime.io/advisories/CVE-2025-1878.md)
  `CVE-2025-1878` · CVE record: i-Drive i11 and 1 more · CVSS 2.3 Low · Not analysed yet · Published 3 Mar 2025 · Tags: CWE-1393
- [Hirsch Enterphone MESH: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH…](https://agentprime.io/advisories/CVE-2025-26793.md)
  `CVE-2025-26793` · CVE record: Hirsch Enterphone MESH · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Feb 2025 · Tags: CWE-1393
- [Plaintext default credentials in firmware](https://agentprime.io/advisories/CVE-2024-43659.md)
  `CVE-2024-43659` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 8.3 High · Not analysed yet · Published 9 Jan 2025 · Tags: Hard-coded credentials, CWE-256, CWE-1393
- [Force Change of Default Credentials](https://agentprime.io/advisories/CVE-2024-51555.md)
  `CVE-2024-51555` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2024 · Tags: CWE-1393
- [Unprotected Exposed Firebird Database with default credentials](https://agentprime.io/advisories/CVE-2024-50588.md)
  `CVE-2024-50588` · CVE record: HASOMED Elefant · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Nov 2024 · Tags: CWE-419, CWE-1393
- [Snipe-IT remote code execution](https://agentprime.io/advisories/GHSA-57qh-vmjr-5jxg.md)
  `GHSA-57qh-vmjr-5jxg`, `CVE-2024-48987`, `PKSA-xdch-tcv5-mhm5` · Packagist `snipe/snipe-it`: affected `<7.0.10`, fixed in `7.0.10` · CVSS 7.2 High · Not analysed yet · Published 11 Oct 2024 · Tags: CWE-1393
- [An issue was discovered on Swissphone DiCal-RED 4009 devices.](https://agentprime.io/advisories/CVE-2024-36440.md)
  `CVE-2024-36440` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 22 Aug 2024 · Tags: Weak cryptography or TLS, CWE-759, CWE-1393
- [Remote command execution due to use of default passwords.](https://agentprime.io/advisories/CVE-2023-45249.md)
  `CVE-2023-45249` · CVE record: Acronis Acronis Cyber Infrastructure · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.54 · Not analysed yet · Published 24 Jul 2024 · Tags: CWE-1393
- [An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component.](https://agentprime.io/advisories/CVE-2024-30802.md)
  `CVE-2024-30802` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 May 2024 · Tags: CWE-1393
- [SSRF into Sandbox Escape through Unsafe Default Configuration](https://agentprime.io/advisories/CVE-2024-29021.md)
  `CVE-2024-29021` · CVE record: judge0 judge0 · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 18 Apr 2024 · Tags: Server-side request forgery (SSRF), CWE-1393
- [Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default password component.](https://agentprime.io/advisories/CVE-2024-29666.md)
  `CVE-2024-29666` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Mar 2024 · Tags: CWE-1393
- [IBM Storage Virtualize information disclosure](https://agentprime.io/advisories/CVE-2023-43042.md)
  `CVE-2023-43042` · CVE record: IBM Storage Virtualize · CVSS 7.5 High · Not analysed yet · Published 14 Dec 2023 · Tags: CWE-1393
- [An issue was discovered on Connectize AC21000 G6 641.139.1.1256 allows attackers to gain escalated privileges on the device via poor credential management.](https://agentprime.io/advisories/CVE-2023-24049.md)
  `CVE-2023-24049` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Dec 2023 · Tags: CWE-1393
- [Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials](https://agentprime.io/advisories/CVE-2023-32090.md)
  `CVE-2023-32090` · CVE record: Pegasystems Pega Platform · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2023 · Tags: CWE-1393
- [Pegasystems Pega Platform: Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a…](https://agentprime.io/advisories/CVE-2023-28094.md)
  `CVE-2023-28094` · CVE record: Pegasystems Pega Platform · CVSS 8.1 High · Not analysed yet · Published 22 Jun 2023 · Tags: CWE-1393
- [Use of default password vulnerability in CyberPower PowerPanel Business](https://agentprime.io/advisories/CVE-2023-25131.md)
  `CVE-2023-25131` · CVE record: CyberPower PowerPanel Business Local / Remote and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2023 · Tags: CWE-1393
- [Use of Default Password](https://agentprime.io/advisories/CVE-2022-4126.md)
  `CVE-2022-4126` · CVE record: ABB RCCMD · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Mar 2023 · Tags: CWE-1393

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-1393>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-1393/>. Everything for agents: <https://agentprime.io/llms.txt>.