Advisories · Weakness

CWE-255.

Every Advisory and CVE whose sources give the weakness CWE-255, newest first.

CVE-2026-97877 CVE record

CVSS 6.9 Medium

zhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password
- zhistaredu StarTraining
- Hard-coded credentials
- CWE-255
Not analysed yet 25 Sept 2026
CVE-2026-19750 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Tenda CH/CP/TX3 SSH hard-coded password
- Tenda CH
- Tenda CP
- Hard-coded credentials
- CWE-255
Not analysed yet 13 Aug 2026
CVE-2026-11552 CVE record

CVSS 6.9 Medium

SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password
- SourceCodester Onlne Examination & Learning Management System
- SourceCodester Syllabus-aligned Learning Management and Examination System
- Hard-coded credentials
- CWE-255
Not analysed yet 8 Jun 2026
CVE-2026-11515 CVE record

CVSS 6.9 Medium

SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded password
- SourceCodester Barangay Resident Profiling and Information Management System
- Hard-coded credentials
- CWE-255
Not analysed yet 8 Jun 2026
langflow PyPI

CVSS 5.1 Medium

Langflow has an Information Leak through Incomplete API Key Redaction
- CWE-255
- CWE-256
<=1.8.3 · no fixed version yet

GHSA-5jjf-wcvf-923w · CVE-2026-6597 Not analysed yet 20 Apr 2026
CVE-2026-4251 CVE record

CVSS 2.0 Low

CityData CityChat ai.citydata.citychat credentials.json credentials storage
- CityData CityChat
- CWE-255
- CWE-256
Not analysed yet 16 Mar 2026
CVE-2026-4250 CVE record

CVSS 2.0 Low

Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage
- Albert Sağlık Hizmetleri ve Ticaret Albert Health
- CWE-255
- CWE-256
Not analysed yet 16 Mar 2026
CVE-2026-4243 CVE record

CVSS 2.0 Low

La Nacion App app.lanacion.activity BuildConfig.java credentials storage
- La Nacion App
- CWE-255
- CWE-256
Not analysed yet 16 Mar 2026
CVE-2026-4242 CVE record

CVSS 2.0 Low

BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage
- BabyChakra Pregnancy & Parenting App
- CWE-255
- CWE-256
Not analysed yet 16 Mar 2026
CVE-2026-4217 CVE record

CVSS 2.0 Low

XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage
- XREAL Nebula App
- CWE-255
- CWE-256
Not analysed yet 16 Mar 2026
CVE-2025-15151 CVE record

CVSS 6.3 Medium

TaleLin Lin-CMS Tests Folder config.py password in configuration file
- TaleLin Lin-CMS
- CWE-255
- CWE-260
Not analysed yet 28 Dec 2025
CVE-2025-15128 CVE record

CVSS 6.9 Medium

ZKTeco BioTime Endpoint safe_setting credentials storage
- ZKTeco BioTime
- CWE-255
- CWE-256
Not analysed yet 28 Dec 2025
CVE-2025-14183 CVE record

CVSS 5.3 Medium

SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storage
- SGAI Space1 NAS N1211DS
- CWE-255
- CWE-256
Not analysed yet 7 Dec 2025
CVE-2025-13221 CVE record

CVSS 6.9 Medium

Intelbras UnniTI usuarios.xml credentials storage
- Intelbras UnniTI
- CWE-255
- CWE-256
Not analysed yet 15 Nov 2025
CVE-2025-13187 CVE record

CVSS 6.9 Medium

Intelbras ICIP acessodeusuario.xml credentials storage
- Intelbras ICIP
- CWE-255
- CWE-256
Not analysed yet 14 Nov 2025
CVE-2025-11666 CVE record

CVSS 8.4 High

Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password
- Tenda RP3 Pro
- Hard-coded credentials
- CWE-255
Not analysed yet 13 Oct 2025
CVE-2025-11649 CVE record

CVSS 7.3 High

Tomofun Furbo 360/Furbo Mini Root Account hard-coded password
- Tomofun Furbo 360
- Tomofun Furbo Mini
- Hard-coded credentials
- CWE-255
Not analysed yet 12 Oct 2025
CVE-2025-11284 CVE record

CVSS 6.9 Medium

Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password
- Zytec Dalian Zhuoyun Technology Central Authentication Service
- Hard-coded credentials
- CWE-255
Not analysed yet 5 Oct 2025
CVE-2025-9725 CVE record

CVSS 2.0 Low

Cudy LT500E Web shadow hard-coded password
- Cudy LT500E
- Hard-coded credentials
- CWE-255
Not analysed yet 31 Aug 2025
CVE-2025-7577 CVE record

CVSS 6.3 Medium

Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded password
- Teledyne FLIR FB-Series O
- Teledyne FLIR FH-Series ID
- Hard-coded credentials
- CWE-255
Not analysed yet 14 Jul 2025
github.com/saltbo/zpan Go

CVSS 6.3 Medium

ZPan Uses Hard-Coded Password
- Hard-coded credentials
- CWE-255
<1.6.6 · fixed in 1.6.6

GHSA-2hfh-94w5-wxvf · CVE-2025-7453 Not analysed yet 11 Jul 2025
CVE-2025-7080 CVE record

CVSS 6.3 Medium

Done-0 Jank JWT Token jwt_utils.go hard-coded password
- Done-0 Jank
- Hard-coded credentials
- CWE-255
Not analysed yet 6 Jul 2025
CVE-2025-7079 CVE record

CVSS 6.3 Medium

mao888 bluebell-plus JWT Token jwt.go hard-coded password
- mao888 bluebell-plus
- Hard-coded credentials
- CWE-255
Not analysed yet 6 Jul 2025
CVE-2025-6932 CVE record

CVSS 6.3 Medium

D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password
- D-Link DCS-7517
- Hard-coded credentials
- CWE-255
Not analysed yet 30 Jun 2025
CVE-2025-6139 CVE record

CVSS 2.0 Low

TOTOLINK T10 shadow.sample hard-coded password
- TOTOLINK T10
- Hard-coded credentials
- CWE-255
Not analysed yet 16 Jun 2025
CVE-2025-4286 CVE record

CVSS 5.1 Medium

Intelbras InControl Dispositivos Edição Page credentials storage
- Intelbras InControl
- CWE-255
- CWE-256
Not analysed yet 5 May 2025
CVE-2025-2555 CVE record

CVSS 2.1 Low

Audi Universal Traffic Recorder App FTP Credentials hard-coded password
- Audi Universal Traffic Recorder App
- Hard-coded credentials
- CWE-255
Not analysed yet 20 Mar 2025
CVE-2025-2355 CVE record

CVSS 4.8 Medium

BlackVue App API Endpoint credentials storage
- BlackVue App
- CWE-255
- CWE-256
Not analysed yet 17 Mar 2025
CVE-2021-37000 CVE record

CVSS 7.7 High

Incorrect default permissions in Huawei HarmonyOS
- Huawei HarmonyOS
- Broken access control
- CWE-255
Not analysed yet 28 Dec 2024
CVE-2024-11026 CVE record

CVSS 6.3 Medium

Intelligent Apps Freenow App Keystore SSL.java hard-coded password
- Intelligent Apps Freenow App
- Hard-coded credentials
- CWE-255
Not analysed yet 8 Nov 2024
CVE-2021-28509 CVE record

CVSS 6.1 Medium

TerminAttr streams MACsec sensitive data in clear text to other authorized users in CVP
- Arista Networks Arista EOS
- Arista Networks Arista TerminAttr
- CWE-255
Not analysed yet 26 May 2022
CVE-2021-28508 CVE record

CVSS 6.8 Medium

TerminAttr streams IPsec sensitive data in clear text to other authorized users in CVP
- Arista Networks Arista EOS
- Arista Networks Arista TerminAttr
- CWE-255
Not analysed yet 26 May 2022
github.com/google/fscrypt Go

CVSS 5.5 Medium

Denial of service via insufficient metadata validation
- CWE-255
<0.3.3 · fixed in 0.3.3

GHSA-p93v-m2r2-4387 · CVE-2022-25327 Not analysed yet 1 Mar 2022
CVE-2020-8968 CVE record

CVSS 7.1 High

Parallels Remote Application Server credentials management errors
- Parallels Remote Application Server (Client)
- CWE-255
Not analysed yet 17 Dec 2021
CVE-2021-22568 CVE record

CVSS 8.8 High

Dart - Publishing to third-party package repositories may expose pub.dev credentials
- Google LLC Dart SDK
- CWE-255
Not analysed yet 9 Dec 2021
CVE-2021-21522 CVE record

CVSS 8.2 High

Dell BIOS contains a Credentials Management issue.
- Dell CPG BIOS
- CWE-255
Not analysed yet 28 Sept 2021
CVE-2021-28499 CVE record

CVSS 6.3 Medium

Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…
- Arista Metamako Operating System
- CWE-255
Not analysed yet 9 Sept 2021
CVE-2021-28498 CVE record

CVSS 8.7 High

Arista Metamako Operating System: In Arista's MOS (Metamako Operating System) software which is supported on the 7130…
- Arista Metamako Operating System
- CWE-255
Not analysed yet 9 Sept 2021
CVE-2021-1522 CVE record

CVSS 4.3 Medium

Cisco Connected Mobile Experiences Strong Authentication Requirements Enforcement Bypass
- Cisco Connected Mobile Experiences
- CWE-255
Not analysed yet 4 Aug 2021
CVE-2021-21505 CVE record

CVSS 8.0 High

Dell EMC Integrated System for Microsoft Azure Stack Hub: Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011…
- Dell EMC Integrated System for Microsoft Azure Stack Hub
- CWE-255
Not analysed yet 6 May 2021
CVE-2020-24680 CVE record

CVSS 7.0 High

Improper Credential Storage in Symphony Plus
- ABB Ability™ Symphony® Plus Operations
- ABB Ability™ Symphony® Plus Historian
- CWE-255
Not analysed yet 22 Dec 2020
CVE-2020-3140 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Cisco Prime License Manager Privilege Escalation Vulnerability
- Cisco Prime License Manager
- CWE-255
Not analysed yet 16 Jul 2020
CVE-2020-10287 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

RVD#3326: Hardcoded default credentials on IRC 5 OPC Server
- ABB IRB140
- CWE-255
Not analysed yet 15 Jul 2020
CVE-2020-1978 CVE record

CVSS 5.8 Medium

VM-Series on Microsoft Azure: Inadvertent collection of credentials in Tech support files on HA configured VMs
- Palo Alto Networks VM-Series Plugin
- CWE-255
Not analysed yet 8 Apr 2020
CVE-2019-1950 CVE record

CVSS 8.4 High

Cisco IOS XE SD-WAN Software Default Credentials Vulnerability
- Cisco IOS XE SD-WAN Software
- CWE-255
Not analysed yet 19 Feb 2020
CVE-2019-7488 CVE record

SonicWall Email Security Appliance: Weak default password cause vulnerability in SonicWall Email Security appliance which…
- SonicWall Email Security Appliance
- CWE-255
Not analysed yet 23 Dec 2019
CVE-2018-7820 CVE record

Schneider Electric SE APC UPS Network Management Card 2 AOS: A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management…
- Schneider Electric SE APC UPS Network Management Card 2 AOS
- CWE-255
Not analysed yet 17 Sept 2019
CVE-2018-7788 CVE record

Modicon Quantum with firmware versions prior to V2.40.: A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware…
- Modicon Quantum with firmware versions prior to V2.40.
- CWE-255
Not analysed yet 22 May 2019
CVE-2019-1714 CVE record

CVSS 5.8 Medium

Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software VPN SAML Authentication Bypass Vulnerability
- Cisco Adaptive Security Appliance (ASA) Software
- Cisco Firepower Threat Defense (FTD) Software
- CWE-255
Not analysed yet 3 May 2019
CVE-2019-1654 CVE record

CVSS 7.8 High

Cisco Aironet Series Access Points Development Shell Access Vulnerability
- Cisco Aironet Access Point Software
- CWE-255
Not analysed yet 17 Apr 2019
CVE-2010-5305 CVE record

Rockwell PLC5/SLC5/0x/RSLogix Credentials management
- Rockwell Automation PLC5
- Rockwell Automation SLC5/0x
- CWE-255
Not analysed yet 26 Mar 2019
CVE-2018-15719 CVE record

Open Dental: Open Dental before version 18.4 installs a mysql database and uses the default…
- Open Dental
- CWE-255
Not analysed yet 12 Dec 2018
CVE-2018-15389 CVE record

Cisco Prime Collaboration Provisioning Intermittent Hard-Coded Password Vulnerability
- Cisco Prime Collaboration Provisioning
- CWE-255
Not analysed yet 5 Oct 2018
CVE-2016-6554 CVE record

Synology NAS servers DS107, DS116, and DS213, use default credentials
- Synology NAS server DS107
- Synology NAS server DS116
- CWE-255
Not analysed yet 13 Jul 2018
CVE-2016-6553 CVE record

Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses default credentials
- Nuuo NT-4040 Titan
- CWE-255
Not analysed yet 13 Jul 2018
CVE-2016-6552 CVE record

Green Packet DX-350 uses default credentials
- Green Packet WiFi Access Point
- CWE-255
Not analysed yet 13 Jul 2018
CVE-2016-6551 CVE record

Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses default credentials
- Intellian Satellite TV Antennas
- CWE-255
Not analysed yet 13 Jul 2018
CVE-2018-0319 CVE record

A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.
- Cisco Prime Collaboration Provisioning unknown
- CWE-255
Not analysed yet 7 Jun 2018
CVE-2018-0318 CVE record

A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device.
- Cisco Prime Collaboration Provisioning unknown
- CWE-255
Not analysed yet 7 Jun 2018
CVE-2018-0226 CVE record

Cisco Aironet 1800, 2800, and 3800 Series Access Points: A vulnerability in the assignment and management of default user accounts for Secure…
- Cisco Aironet 1800, 2800, and 3800 Series Access Points
- CWE-255
Not analysed yet 2 May 2018