# CWE-255.

Every Advisory and CVE whose sources give the weakness CWE-255, newest first.

## Records, newest first

- [zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password](https://agentprime.io/advisories/CVE-2026-97877.md)
  `CVE-2026-97877` · CVE record: zhistaredu StarTraining · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Hard-coded credentials, CWE-255
- [Tenda CH/CP/TX3 SSH hard-coded password](https://agentprime.io/advisories/CVE-2026-19750.md)
  `CVE-2026-19750` · CVE record: Tenda CH and 2 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Hard-coded credentials, CWE-255
- [SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password](https://agentprime.io/advisories/CVE-2026-11552.md)
  `CVE-2026-11552` · CVE record: SourceCodester Onlne Examination & Learning Management System and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-255
- [SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded password](https://agentprime.io/advisories/CVE-2026-11515.md)
  `CVE-2026-11515` · CVE record: SourceCodester Barangay Resident Profiling and Information Management System · CVSS 6.9 Medium · Not analysed yet · Published 8 Jun 2026 · Tags: Hard-coded credentials, CWE-255
- [Langflow has an Information Leak through Incomplete API Key Redaction](https://agentprime.io/advisories/GHSA-5jjf-wcvf-923w.md)
  `GHSA-5jjf-wcvf-923w`, `CVE-2026-6597`, `PYSEC-2026-2565` · PyPI `langflow`: affected `<=1.8.3`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-255, CWE-256
- [CityData CityChat ai.citydata.citychat credentials.json credentials storage](https://agentprime.io/advisories/CVE-2026-4251.md)
  `CVE-2026-4251` · CVE record: CityData CityChat · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage](https://agentprime.io/advisories/CVE-2026-4250.md)
  `CVE-2026-4250` · CVE record: Albert Sağlık Hizmetleri ve Ticaret Albert Health · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [La Nacion App app.lanacion.activity BuildConfig.java credentials storage](https://agentprime.io/advisories/CVE-2026-4243.md)
  `CVE-2026-4243` · CVE record: La Nacion App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage](https://agentprime.io/advisories/CVE-2026-4242.md)
  `CVE-2026-4242` · CVE record: BabyChakra Pregnancy & Parenting App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage](https://agentprime.io/advisories/CVE-2026-4217.md)
  `CVE-2026-4217` · CVE record: XREAL Nebula App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [TaleLin Lin-CMS Tests Folder config.py password in configuration file](https://agentprime.io/advisories/CVE-2025-15151.md)
  `CVE-2025-15151` · CVE record: TaleLin Lin-CMS · CVSS 6.3 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: CWE-255, CWE-260
- [ZKTeco BioTime Endpoint safe_setting credentials storage](https://agentprime.io/advisories/CVE-2025-15128.md)
  `CVE-2025-15128` · CVE record: ZKTeco BioTime · CVSS 6.9 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: CWE-255, CWE-256
- [SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storage](https://agentprime.io/advisories/CVE-2025-14183.md)
  `CVE-2025-14183` · CVE record: SGAI Space1 NAS N1211DS · CVSS 5.3 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: CWE-255, CWE-256
- [Intelbras UnniTI usuarios.xml credentials storage](https://agentprime.io/advisories/CVE-2025-13221.md)
  `CVE-2025-13221` · CVE record: Intelbras UnniTI · CVSS 6.9 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: CWE-255, CWE-256
- [Intelbras ICIP acessodeusuario.xml credentials storage](https://agentprime.io/advisories/CVE-2025-13187.md)
  `CVE-2025-13187` · CVE record: Intelbras ICIP · CVSS 6.9 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: CWE-255, CWE-256
- [Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password](https://agentprime.io/advisories/CVE-2025-11666.md)
  `CVE-2025-11666` · CVE record: Tenda RP3 Pro · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2025 · Tags: Hard-coded credentials, CWE-255
- [Tomofun Furbo 360/Furbo Mini Root Account hard-coded password](https://agentprime.io/advisories/CVE-2025-11649.md)
  `CVE-2025-11649` · CVE record: Tomofun Furbo 360 and 1 more · CVSS 7.3 High · Not analysed yet · Published 12 Oct 2025 · Tags: Hard-coded credentials, CWE-255
- [Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password](https://agentprime.io/advisories/CVE-2025-11284.md)
  `CVE-2025-11284` · CVE record: Zytec Dalian Zhuoyun Technology Central Authentication Service · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Hard-coded credentials, CWE-255
- [Cudy LT500E Web shadow hard-coded password](https://agentprime.io/advisories/CVE-2025-9725.md)
  `CVE-2025-9725` · CVE record: Cudy LT500E · CVSS 2.0 Low · Not analysed yet · Published 31 Aug 2025 · Tags: Hard-coded credentials, CWE-255
- [Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded password](https://agentprime.io/advisories/CVE-2025-7577.md)
  `CVE-2025-7577` · CVE record: Teledyne FLIR FB-Series O and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2025 · Tags: Hard-coded credentials, CWE-255
- [ZPan Uses Hard-Coded Password](https://agentprime.io/advisories/GHSA-2hfh-94w5-wxvf.md)
  `GHSA-2hfh-94w5-wxvf`, `CVE-2025-7453`, `GO-2026-6014` · Go `github.com/saltbo/zpan`: affected `<1.6.6`, fixed in `1.6.6` · CVSS 6.3 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: Hard-coded credentials, CWE-255
- [Done-0 Jank JWT Token jwt_utils.go hard-coded password](https://agentprime.io/advisories/CVE-2025-7080.md)
  `CVE-2025-7080` · CVE record: Done-0 Jank · CVSS 6.3 Medium · Not analysed yet · Published 6 Jul 2025 · Tags: Hard-coded credentials, CWE-255
- [mao888 bluebell-plus JWT Token jwt.go hard-coded password](https://agentprime.io/advisories/CVE-2025-7079.md)
  `CVE-2025-7079` · CVE record: mao888 bluebell-plus · CVSS 6.3 Medium · Not analysed yet · Published 6 Jul 2025 · Tags: Hard-coded credentials, CWE-255
- [D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password](https://agentprime.io/advisories/CVE-2025-6932.md)
  `CVE-2025-6932` · CVE record: D-Link DCS-7517 · CVSS 6.3 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: Hard-coded credentials, CWE-255
- [TOTOLINK T10 shadow.sample hard-coded password](https://agentprime.io/advisories/CVE-2025-6139.md)
  `CVE-2025-6139` · CVE record: TOTOLINK T10 · CVSS 2.0 Low · Not analysed yet · Published 16 Jun 2025 · Tags: Hard-coded credentials, CWE-255
- [Intelbras InControl Dispositivos Edição Page credentials storage](https://agentprime.io/advisories/CVE-2025-4286.md)
  `CVE-2025-4286` · CVE record: Intelbras InControl · CVSS 5.1 Medium · Not analysed yet · Published 5 May 2025 · Tags: CWE-255, CWE-256
- [Audi Universal Traffic Recorder App FTP Credentials hard-coded password](https://agentprime.io/advisories/CVE-2025-2555.md)
  `CVE-2025-2555` · CVE record: Audi Universal Traffic Recorder App · CVSS 2.1 Low · Not analysed yet · Published 20 Mar 2025 · Tags: Hard-coded credentials, CWE-255
- [BlackVue App API Endpoint credentials storage](https://agentprime.io/advisories/CVE-2025-2355.md)
  `CVE-2025-2355` · CVE record: BlackVue App · CVSS 4.8 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-255, CWE-256
- [Incorrect default permissions in Huawei HarmonyOS](https://agentprime.io/advisories/CVE-2021-37000.md)
  `CVE-2021-37000` · CVE record: Huawei HarmonyOS · CVSS 7.7 High · Not analysed yet · Published 28 Dec 2024 · Tags: Broken access control, CWE-255
- [Intelligent Apps Freenow App Keystore SSL.java hard-coded password](https://agentprime.io/advisories/CVE-2024-11026.md)
  `CVE-2024-11026` · CVE record: Intelligent Apps Freenow App · CVSS 6.3 Medium · Not analysed yet · Published 8 Nov 2024 · Tags: Hard-coded credentials, CWE-255
- [TerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP](https://agentprime.io/advisories/CVE-2021-28509.md)
  `CVE-2021-28509` · CVE record: Arista Networks Arista EOS and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 26 May 2022 · Tags: CWE-255
- [TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP](https://agentprime.io/advisories/CVE-2021-28508.md)
  `CVE-2021-28508` · CVE record: Arista Networks Arista EOS and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 26 May 2022 · Tags: CWE-255
- [Denial of service via insufficient metadata validation](https://agentprime.io/advisories/GHSA-p93v-m2r2-4387.md)
  `GHSA-p93v-m2r2-4387`, `CVE-2022-25327`, `GHSA-8vwm-8vj8-rqjf`, `GO-2022-0340` · Go `github.com/google/fscrypt`: affected `<0.3.3`, fixed in `0.3.3` · CVSS 5.5 Medium · Not analysed yet · Published 1 Mar 2022 · Tags: CWE-255
- [Parallels Remote Application Server credentials management errors](https://agentprime.io/advisories/CVE-2020-8968.md)
  `CVE-2020-8968` · CVE record: Parallels Parallels Remote Application Server (Client) · CVSS 7.1 High · Not analysed yet · Published 17 Dec 2021 · Tags: CWE-255
- [Dart - Publishing to third-party package repositories may expose pub.dev credentials](https://agentprime.io/advisories/CVE-2021-22568.md)
  `CVE-2021-22568` · CVE record: Google LLC Dart SDK · CVSS 8.8 High · Not analysed yet · Published 9 Dec 2021 · Tags: CWE-255
- [Dell BIOS contains a Credentials Management issue.](https://agentprime.io/advisories/CVE-2021-21522.md)
  `CVE-2021-21522` · CVE record: Dell CPG BIOS · CVSS 8.2 High · Not analysed yet · Published 28 Sept 2021 · Tags: CWE-255
- [Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…](https://agentprime.io/advisories/CVE-2021-28499.md)
  `CVE-2021-28499` · CVE record: Arista Metamako Operating System · CVSS 6.3 Medium · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-255
- [Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…](https://agentprime.io/advisories/CVE-2021-28498.md)
  `CVE-2021-28498` · CVE record: Arista Metamako Operating System · CVSS 8.7 High · Not analysed yet · Published 9 Sept 2021 · Tags: CWE-255
- [Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass](https://agentprime.io/advisories/CVE-2021-1522.md)
  `CVE-2021-1522` · CVE record: Cisco Cisco Connected Mobile Experiences · CVSS 4.3 Medium · Not analysed yet · Published 4 Aug 2021 · Tags: CWE-255
- [Dell EMC Integrated System for Microsoft Azure Stack Hub: Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011…](https://agentprime.io/advisories/CVE-2021-21505.md)
  `CVE-2021-21505` · CVE record: Dell Dell EMC Integrated System for Microsoft Azure Stack Hub · CVSS 8.0 High · Not analysed yet · Published 6 May 2021 · Tags: CWE-255
- [Improper Credential Storage in Symphony Plus](https://agentprime.io/advisories/CVE-2020-24680.md)
  `CVE-2020-24680` · CVE record: ABB ABB Ability™ Symphony® Plus Operations and 1 more · CVSS 7.0 High · Not analysed yet · Published 22 Dec 2020 · Tags: CWE-255
- [Cisco Prime License Manager Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2020-3140.md)
  `CVE-2020-3140` · CVE record: Cisco Cisco Prime License Manager · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2020 · Tags: CWE-255
- [RVD#3326: Hardcoded default credentials on IRC 5 OPC Server](https://agentprime.io/advisories/CVE-2020-10287.md)
  `CVE-2020-10287` · CVE record: ABB IRB140 · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2020 · Tags: CWE-255
- [VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs](https://agentprime.io/advisories/CVE-2020-1978.md)
  `CVE-2020-1978` · CVE record: Palo Alto Networks VM-Series Plugin · CVSS 5.8 Medium · Not analysed yet · Published 8 Apr 2020 · Tags: CWE-255
- [Cisco IOS XE SD-WAN Software Default Credentials Vulnerability](https://agentprime.io/advisories/CVE-2019-1950.md)
  `CVE-2019-1950` · CVE record: Cisco Cisco IOS XE SD-WAN Software · CVSS 8.4 High · Not analysed yet · Published 19 Feb 2020 · Tags: CWE-255
- [SonicWall Email Security Appliance: Weak default password cause vulnerability in SonicWall Email Security appliance which…](https://agentprime.io/advisories/CVE-2019-7488.md)
  `CVE-2019-7488` · CVE record: SonicWall Email Security Appliance · No CVSS score · Not analysed yet · Published 23 Dec 2019 · Tags: CWE-255
- [Schneider Electric SE APC UPS Network Management Card 2 AOS: A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management…](https://agentprime.io/advisories/CVE-2018-7820.md)
  `CVE-2018-7820` · CVE record: Schneider Electric SE APC UPS Network Management Card 2 AOS · No CVSS score · Not analysed yet · Published 17 Sept 2019 · Tags: CWE-255
- [Modicon Quantum with firmware versions prior to V2.40.: A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware…](https://agentprime.io/advisories/CVE-2018-7788.md)
  `CVE-2018-7788` · CVE record: Modicon Quantum with firmware versions prior to V2.40. · No CVSS score · Not analysed yet · Published 22 May 2019 · Tags: CWE-255
- [Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software VPN SAML Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2019-1714.md)
  `CVE-2019-1714` · CVE record: Cisco Cisco Adaptive Security Appliance (ASA) Software and 1 more · CVSS 5.8 Medium · Not analysed yet · Published 3 May 2019 · Tags: CWE-255
- [Cisco Aironet Series Access Points Development Shell Access Vulnerability](https://agentprime.io/advisories/CVE-2019-1654.md)
  `CVE-2019-1654` · CVE record: Cisco Cisco Aironet Access Point Software · CVSS 7.8 High · Not analysed yet · Published 17 Apr 2019 · Tags: CWE-255
- [Rockwell PLC5/SLC5/0x/RSLogix Credentials management](https://agentprime.io/advisories/CVE-2010-5305.md)
  `CVE-2010-5305` · CVE record: Rockwell Automation PLC5 and 2 more · No CVSS score · Not analysed yet · Published 26 Mar 2019 · Tags: CWE-255
- [Open Dental: Open Dental before version 18.4 installs a mysql database and uses the default…](https://agentprime.io/advisories/CVE-2018-15719.md)
  `CVE-2018-15719` · CVE record: Open Dental Open Dental · No CVSS score · Not analysed yet · Published 12 Dec 2018 · Tags: CWE-255
- [Cisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability](https://agentprime.io/advisories/CVE-2018-15389.md)
  `CVE-2018-15389` · CVE record: Cisco Cisco Prime Collaboration Provisioning · No CVSS score · Not analysed yet · Published 5 Oct 2018 · Tags: CWE-255
- [Synology NAS servers DS107, DS116, and DS213, use default credentials](https://agentprime.io/advisories/CVE-2016-6554.md)
  `CVE-2016-6554` · CVE record: Synology NAS server DS107 and 2 more · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-255
- [Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials](https://agentprime.io/advisories/CVE-2016-6553.md)
  `CVE-2016-6553` · CVE record: Nuuo NT-4040 Titan · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-255
- [Green Packet DX-350 uses default credentials](https://agentprime.io/advisories/CVE-2016-6552.md)
  `CVE-2016-6552` · CVE record: Green Packet WiFi Access Point · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-255
- [Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials](https://agentprime.io/advisories/CVE-2016-6551.md)
  `CVE-2016-6551` · CVE record: Intellian Satellite TV Antennas · No CVSS score · Not analysed yet · Published 13 Jul 2018 · Tags: CWE-255
- [A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.](https://agentprime.io/advisories/CVE-2018-0319.md)
  `CVE-2018-0319` · CVE record: Cisco Prime Collaboration Provisioning unknown · No CVSS score · Not analysed yet · Published 7 Jun 2018 · Tags: CWE-255
- [A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.](https://agentprime.io/advisories/CVE-2018-0318.md)
  `CVE-2018-0318` · CVE record: Cisco Prime Collaboration Provisioning unknown · No CVSS score · Not analysed yet · Published 7 Jun 2018 · Tags: CWE-255
- [Cisco Aironet 1800, 2800, and 3800 Series Access Points: A vulnerability in the assignment and management of default user accounts for Secure…](https://agentprime.io/advisories/CVE-2018-0226.md)
  `CVE-2018-0226` · CVE record: Cisco Aironet 1800, 2800, and 3800 Series Access Points · No CVSS score · Not analysed yet · Published 2 May 2018 · Tags: CWE-255

Older: <https://agentprime.io/advisories/tag/cwe-255.md?cursor=WyIyMDE4LTA1LTAyVDIyOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAxOC0wMjI2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-255>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-255/>. Everything for agents: <https://agentprime.io/llms.txt>.