# CWE-256.

Every Advisory and CVE whose sources give the weakness CWE-256, newest first.

## Records, newest first (an older page)

- [Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system.](https://agentprime.io/advisories/CVE-2025-66910.md)
  `CVE-2025-66910` · CVE record · CVSS 6.0 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: Information disclosure, CWE-256
- [Insecure Password Storage in WODESYS WD-R608U router](https://agentprime.io/advisories/CVE-2025-65009.md)
  `CVE-2025-65009` · CVE record: WODESYS WD-R608U and 2 more · CVSS 7.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-256
- [HCL Workload Scheduler is vulnerable to plain text storage of a password](https://agentprime.io/advisories/CVE-2024-42197.md)
  `CVE-2024-42197` · CVE record: HCL Software Workload Scheduler · CVSS 5.5 Medium · Not analysed yet · Published 11 Dec 2025 · Tags: CWE-256
- [SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET_USER_INFO credentials storage](https://agentprime.io/advisories/CVE-2025-14183.md)
  `CVE-2025-14183` · CVE record: SGAI Space1 NAS N1211DS · CVSS 5.3 Medium · Not analysed yet · Published 7 Dec 2025 · Tags: CWE-255, CWE-256
- [Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.](https://agentprime.io/advisories/CVE-2025-56527.md)
  `CVE-2025-56527` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2025 · Tags: CWE-256
- [Intelbras UnniTI usuarios.xml credentials storage](https://agentprime.io/advisories/CVE-2025-13221.md)
  `CVE-2025-13221` · CVE record: Intelbras UnniTI · CVSS 6.9 Medium · Not analysed yet · Published 15 Nov 2025 · Tags: CWE-255, CWE-256
- [Intelbras ICIP acessodeusuario.xml credentials storage](https://agentprime.io/advisories/CVE-2025-13187.md)
  `CVE-2025-13187` · CVE record: Intelbras ICIP · CVSS 6.9 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: CWE-255, CWE-256
- [Hard-coded admin credentials in Quick.CMS](https://agentprime.io/advisories/CVE-2025-9982.md)
  `CVE-2025-9982` · CVE record: OpenSolution QuickCMS · CVSS 6.9 Medium · Not analysed yet · Published 14 Nov 2025 · Tags: CWE-256
- [Plaintext password storage in Dell CloudLink](https://agentprime.io/advisories/CVE-2025-46366.md)
  `CVE-2025-46366` · CVE record: Dell CloudLink · CVSS 6.7 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: CWE-256
- [Plaintext password storage in Lenovo Tab M11 TB330FU TB330XU and others](https://agentprime.io/advisories/CVE-2025-11193.md)
  `CVE-2025-11193` · CVE record: Lenovo Tab M11 TB330FU TB330XU and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: CWE-256
- [IBM Sterling B2B Integrator information disclosure](https://agentprime.io/advisories/CVE-2025-36002.md)
  `CVE-2025-36002` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-256, CWE-260
- [Minecraft RCON Terminal: Plain Text Password Storage in Configuration](https://agentprime.io/advisories/CVE-2025-61680.md)
  `CVE-2025-61680` · CVE record: jaketcooper Minecraft-rcon · CVSS 6.6 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-256
- [Vasion Print (formerly PrinterLogic) Readable Cleartext Passwords](https://agentprime.io/advisories/CVE-2025-34210.md)
  `CVE-2025-34210` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2025 · Tags: CWE-256
- [Plaintext password storage in Dell PowerProtect Data Manager](https://agentprime.io/advisories/CVE-2025-43938.md)
  `CVE-2025-43938` · CVE record: Dell PowerProtect Data Manager · CVSS 5.0 Medium · Not analysed yet · Published 10 Sept 2025 · Tags: CWE-256
- [Multi Linux Manager epxoses the plain text HTTP Proxy user:password in logs](https://agentprime.io/advisories/CVE-2025-46809.md)
  `CVE-2025-46809` · CVE record: SUSE Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1 and 4 more · CVSS 6.9 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: CWE-256
- [SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext.](https://agentprime.io/advisories/CVE-2025-45702.md)
  `CVE-2025-45702` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 24 Jul 2025 · Tags: CWE-256
- [Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext.](https://agentprime.io/advisories/CVE-2025-52164.md)
  `CVE-2025-52164` · CVE record · CVSS 8.2 High · Not analysed yet · Published 18 Jul 2025 · Tags: CWE-256
- [Plaintext Storage of a Password in LITEON IC48A and IC80A EV Chargers](https://agentprime.io/advisories/CVE-2025-7357.md)
  `CVE-2025-7357` · CVE record: LITEON IC48A EV Charger and 1 more · CVSS 8.7 High · Not analysed yet · Published 16 Jul 2025 · Tags: CWE-256
- [Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form](https://agentprime.io/advisories/GHSA-8gp3-m447-gw2v.md)
  `GHSA-8gp3-m447-gw2v`, `CVE-2025-53669` · Maven `org.jenkins-ci.plugins:vaddy-plugin`: affected `<=1.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Warrior Framework Plugin vulnerability exposes unencrypted passwords to certain authenticated users](https://agentprime.io/advisories/GHSA-2g8w-9933-36vr.md)
  `GHSA-2g8w-9933-36vr`, `CVE-2025-53675` · Maven `org.jenkins-ci.plugins:warrior`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Xooa Plugin vulnerability does not mask its Xooa Deployment Token](https://agentprime.io/advisories/GHSA-23j7-px3w-jwp2.md)
  `GHSA-23j7-px3w-jwp2`, `CVE-2025-53677` · Maven `io.jenkins.plugins:xooa`: affected `<=0.0.7`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens](https://agentprime.io/advisories/GHSA-vx57-hphr-3mr9.md)
  `GHSA-vx57-hphr-3mr9`, `CVE-2025-53674` · Maven `org.jenkins-ci.plugins:sensedia-api-platform`: affected `<=1.0`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-q8p4-vw42-66gh.md)
  `GHSA-q8p4-vw42-66gh`, `CVE-2025-53664` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys](https://agentprime.io/advisories/GHSA-jxwj-qccf-4896.md)
  `GHSA-jxwj-qccf-4896`, `CVE-2025-53662` · Maven `org.jenkins-ci.plugins:ifttt-build-notifier`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins QMetry Test Management Plugin vulnerability exposes API keys](https://agentprime.io/advisories/GHSA-962q-84v8-hxhj.md)
  `GHSA-962q-84v8-hxhj`, `CVE-2025-53660` · Maven `org.jenkins-ci.plugins:qmetry-test-management`: affected `<=1.13`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials](https://agentprime.io/advisories/GHSA-884f-p57j-f258.md)
  `GHSA-884f-p57j-f258`, `CVE-2025-53656` · Maven `org.jenkins-ci.plugins:soapui-pro-functional-testing`: affected `<=1.11`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form](https://agentprime.io/advisories/GHSA-4v4v-92cx-x4f4.md)
  `GHSA-4v4v-92cx-x4f4`, `CVE-2025-53671` · Maven `org.jenkins-ci.plugins:nouvola-divecloud`: affected `<=1.08`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-28j3-hphh-cjr8.md)
  `GHSA-28j3-hphh-cjr8`, `CVE-2025-53665` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256
- [Jenkins Statistics Gatherer Plugin does not mask AWS Secret Key](https://agentprime.io/advisories/GHSA-26x3-7jw5-7mg4.md)
  `GHSA-26x3-7jw5-7mg4`, `CVE-2025-53655` · Maven `org.jenkins.plugins.statistics.gatherer:statistics-gatherer`: affected `<=2.0.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: CWE-256
- [CVE-2025-1709](https://agentprime.io/advisories/CVE-2025-1709.md)
  `CVE-2025-1709` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 6.5 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-256
- [Hunt Electronic Hybrid DVR - Exposure of Sensitive System Information](https://agentprime.io/advisories/CVE-2025-6561.md)
  `CVE-2025-6561` · CVE record: Hunt Electronic HBF-09KD and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jun 2025 · Tags: Information disclosure, CWE-256
- [Sapido Wireless Router - Exposure of Sensitive Information](https://agentprime.io/advisories/CVE-2025-6560.md)
  `CVE-2025-6560` · CVE record: Sapido BR071n and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-256
- [Honding Technology Smart Parking Management System - Exposure of Sensitive Information](https://agentprime.io/advisories/CVE-2025-5893.md)
  `CVE-2025-5893` · CVE record: Honding Technology Smart Parking Management System · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Jun 2025 · Tags: Information disclosure, CWE-256
- [Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode](https://agentprime.io/advisories/CVE-2025-5760.md)
  `CVE-2025-5760` · CVE record: eskapism Simple History – Track, Log, and Audit WordPress Changes · CVSS 4.9 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: CWE-256
- [Plaintext password storage in Hitachi Energy Asset Suite](https://agentprime.io/advisories/CVE-2025-2500.md)
  `CVE-2025-2500` · CVE record: Hitachi Energy Asset Suite · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2025 · Tags: CWE-256
- [MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext](https://agentprime.io/advisories/CVE-2025-48046.md)
  `CVE-2025-48046` · CVE record: MICI Network Co. Ltd. NetFax Server · CVSS 5.3 Medium · Not analysed yet · Published 29 May 2025 · Tags: CWE-256
- [IBM Controller information disclosure](https://agentprime.io/advisories/CVE-2025-33079.md)
  `CVE-2025-33079` · CVE record: IBM Controller and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-256
- [Information Disclosure vulnerability in SAP GUI for Windows](https://agentprime.io/advisories/CVE-2025-43005.md)
  `CVE-2025-43005` · CVE record: SAP_SE SAP GUI for Windows · CVSS 4.3 Medium · Not analysed yet · Published 13 May 2025 · Tags: CWE-256
- [Exposure of Device Configuration without Authentication in WF2220](https://agentprime.io/advisories/CVE-2025-3758.md)
  `CVE-2025-3758` · CVE record: Netis Systems WF2220 · CVSS 8.7 High · Not analysed yet · Published 8 May 2025 · Tags: Authentication bypass, CWE-256
- [On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be…](https://agentprime.io/advisories/CVE-2025-0936.md)
  `CVE-2025-0936` · CVE record: Arista Networks EOS · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2025 · Tags: CWE-256
- [Intelbras InControl Dispositivos Edição Page credentials storage](https://agentprime.io/advisories/CVE-2025-4286.md)
  `CVE-2025-4286` · CVE record: Intelbras InControl · CVSS 5.1 Medium · Not analysed yet · Published 5 May 2025 · Tags: CWE-255, CWE-256
- [BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-2770.md)
  `CVE-2025-2770` · CVE record: BEC Technologies Multiple Routers · CVSS 4.9 Medium · Not analysed yet · Published 23 Apr 2025 · Tags: CWE-256
- [An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code via the /mnt/mtd/mvconf/wifi.ini and /mn…](https://agentprime.io/advisories/CVE-2025-25985.md)
  `CVE-2025-25985` · CVE record · CVSS 2.6 Low · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-256
- [MySQL K8s charm could leak credentials for root-level user \`serverconfig\`](https://agentprime.io/advisories/CVE-2025-24375.md)
  `CVE-2025-24375` · CVE record: canonical mysql-k8s-operator · CVSS 5.0 Medium · Not analysed yet · Published 9 Apr 2025 · Tags: CWE-256
- [Jenkins Cadence vManager Plugin Stores Verisium Manager vAPI keys Unencrypted](https://agentprime.io/advisories/GHSA-x9hj-q7xv-fv4v.md)
  `GHSA-x9hj-q7xv-fv4v`, `CVE-2025-31724` · Maven `org.jenkins-ci.plugins:vmanager-plugin`: affected `<4.0.1`, fixed in `4.0.1` · CVSS 4.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: Information disclosure, CWE-256
- [IBM InfoSphere Information Server information disclosure](https://agentprime.io/advisories/CVE-2024-43186.md)
  `CVE-2024-43186` · CVE record: IBM InfoSphere Information Server · CVSS 5.3 Medium · Not analysed yet · Published 28 Mar 2025 · Tags: CWE-256
- [Insufficiently Protected Credentials in transformeroptimus/superagi](https://agentprime.io/advisories/CVE-2024-9418.md)
  `CVE-2024-9418` · CVE record: transformeroptimus transformeroptimus/superagi · CVSS 6.5 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: CWE-256
- [BlackVue App API Endpoint credentials storage](https://agentprime.io/advisories/CVE-2025-2355.md)
  `CVE-2025-2355` · CVE record: BlackVue App · CVSS 4.8 Medium · Not analysed yet · Published 17 Mar 2025 · Tags: CWE-255, CWE-256
- [IBM QRadar EDR information disclosure](https://agentprime.io/advisories/CVE-2024-45638.md)
  `CVE-2024-45638` · CVE record: IBM QRadar EDR · CVSS 4.1 Medium · Not analysed yet · Published 14 Mar 2025 · Tags: CWE-256
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.](https://agentprime.io/advisories/CVE-2025-27662.md)
  `CVE-2025-27662` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: CWE-256
- [Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011.](https://agentprime.io/advisories/CVE-2025-27656.md)
  `CVE-2025-27656` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2025 · Tags: CWE-256
- [Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext.](https://agentprime.io/advisories/CVE-2025-25727.md)
  `CVE-2025-25727` · CVE record · CVSS 6.2 Medium · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-256
- [Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor 2133/2762/2832 prior to v3.9.8, Vigor 21…](https://agentprime.io/advisories/CVE-2024-41336.md)
  `CVE-2024-41336` · CVE record · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2025 · Tags: CWE-256
- [Camera passwords stored in clear text](https://agentprime.io/advisories/CVE-2024-10334.md)
  `CVE-2024-10334` · CVE record: ABB System 800xA · CVSS 7.0 High · Not analysed yet · Published 10 Feb 2025 · Tags: CWE-256
- [IBM Common Licensing information disclosure](https://agentprime.io/advisories/CVE-2023-50945.md)
  `CVE-2023-50945` · CVE record: IBM Common Licensing · CVSS 6.2 Medium · Not analysed yet · Published 26 Jan 2025 · Tags: CWE-256
- [Plaintext default credentials in firmware](https://agentprime.io/advisories/CVE-2024-43659.md)
  `CVE-2024-43659` · CVE record: Iocharger Iocharger firmware for AC models · CVSS 8.3 High · Not analysed yet · Published 9 Jan 2025 · Tags: Hard-coded credentials, CWE-256, CWE-1393
- [Plaintext password storage in Dell VxRail HCI](https://agentprime.io/advisories/CVE-2025-21111.md)
  `CVE-2025-21111` · CVE record: Dell Dell VxRail HCI · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-256
- [Plaintext password storage in Dell VxRail HCI](https://agentprime.io/advisories/CVE-2025-21102.md)
  `CVE-2025-21102` · CVE record: Dell Dell VxRail HCI · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2025 · Tags: CWE-256
- [IBM Storage Defender - Resiliency Service information disclosure](https://agentprime.io/advisories/CVE-2024-52361.md)
  `CVE-2024-52361` · CVE record: IBM Storage Defender - Resiliency Service · CVSS 5.7 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-256
- [IBM Storage Defender - Resiliency Service information disclosure](https://agentprime.io/advisories/CVE-2023-50956.md)
  `CVE-2023-50956` · CVE record: IBM Storage Defender - Resiliency Service · CVSS 4.4 Medium · Not analysed yet · Published 18 Dec 2024 · Tags: CWE-256

Newest: <https://agentprime.io/advisories/tag/cwe-256.md>
Older: <https://agentprime.io/advisories/tag/cwe-256.md?cursor=WyIyMDI0LTEyLTE4VDE1OjI0OjU3Ljk0ODAwMFoiLCJDVkUtMjAyMy01MDk1NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-256&cursor=WyIyMDI1LTEyLTI0VDE5OjI3OjQzLjc1MjAwMFoiLCJDVkUtMjAxOC0yNTEzMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-256/?cursor=WyIyMDI1LTEyLTI0VDE5OjI3OjQzLjc1MjAwMFoiLCJDVkUtMjAxOC0yNTEzMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.