CWE-256.

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences

• TPC Software Matchpoint
• CWE-256

Plaintext Storage of LDAP Password in Axxon One Shared Configuration

• AxxonSoft Axxon One
• CWE-256

Clear Text Storage of Password in Crypttech's Vatos DLP

• Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP
• CWE-256

Cleartext Storage of OAuth Credentials in ServiceNow AI Platform

• ServiceNow AI Platform
• CWE-256

Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

• CWE-256

Plaintext storage of a password in WebCTI

• Slican IPx
• CWE-256

Plaintext password storage in Dell Command | Configure (DCC)

• Dell Command | Configure (DCC)
• CWE-256

Plane: Plaintext logging of API token

• plane
• CWE-256

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• CWE-256

Security Advisory 0168

• Arista Networks EOS
• CWE-256

Plaintext password storage in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* and others

• Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
• Contec Co., Ltd. Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1
• CWE-256

Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

• Menulux Software Inc. Menulux Portal
• CWE-256

Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

• OptimiDoc Server
• CWE-256

HDD Password Stored In Plaintext

• Insyde Software InsydeH2O
• CWE-256

rust-iot-platform Cleartext Password Storage via User Model

• iot-ecology rust-iot-platform
• CWE-256

CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

• cloudnative-pg
• Hard-coded credentials
• CWE-256

Plaintext password storage in Streamsoft Business Intelligence

• Streamsoft Business Intelligence
• CWE-256

Hard-coded admin credentials in Quick.Cart

• OpenSolution Quick.Cart
• CWE-256

Weintek cMT3092X Plaintext Storage of a Password

• Weintek cMT3092X firmware
• Weintek EasyWeb
• CWE-256

Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs

• Pronetiqs Panduit Intravue
• CWE-256

Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

• Red Hat Ansible Automation Platform 2
• CWE-256

Frogman: API tokens stored in plaintext

• mwtcmi frogman
• CWE-256

Insecure password storage in User directory

• arcinfo PcVue
• CWE-256

Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding

• Weak cryptography or TLS
• CWE-256

>=4.0.0, <4.2.0 · fixed in 4.2.0

motionEye: Authentication possible via password hash

• Authentication bypass
• Weak cryptography or TLS

<0.44.0 · fixed in 0.44.0

Lemur user-update path stores plaintext passwords

• CWE-256

<1.9.2 · fixed in 1.9.2

Jenkins FitNesse Plugin stores passwords unencrypted

• CWE-256

<=1.36 · no fixed version yet

Plaintext password storage in Dell EMC VxRail Appliance

• Dell EMC VxRail Appliance
• CWE-256

IBM Security QRadar EDR Software has a vulnerability where user credentials may be stored in plain text, potentially exposing sensitive information.

• IBM Security QRadar EDR
• CWE-256

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console.

• CWE-256

Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm

• Heatmiser Wifi Thermostat
• CWE-256

Prometheus Azure AD remote write OAuth client secret exposed via config API

• Information disclosure
• CWE-256

>=0.45.2, <0.311.3 · fixed in 0.311.3

Plaintext password storage in ILM Informatique OpenConcerto

• ILM Informatique OpenConcerto
• CWE-256

Vulnerabilities found

• IBM watsonx.data intelligence
• CWE-256

Langflow has an Information Leak through Incomplete API Key Redaction

• CWE-255
• CWE-256

<=1.8.3 · no fixed version yet

Plaintext Storage of a Password in Sparx Pro Cloud Server.

• Sparx Systems Pty Ltd. Sparx Pro Cloud Server
• CWE-256

Plaintext password storage in Synology SSL VPN Client

• Synology SSL VPN Client
• CWE-256

Plaintext storage of a password in OpenPLC_V3

• OpenPLC_V3
• CWE-256

openssl-encrypt has visible password in process list via --password CLI argument

• CWE-214
• CWE-256

<1.4.0 · fixed in 1.4.0

IBM InfoSphere Information Server is vulnerable due to plaintext storage of a password

• IBM InfoSphere Information Server
• CWE-256

NATS has MQTT plaintext password disclosure

• CWE-213
• CWE-256

* · no fixed version yet

Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+

• Nexxt Solutions Nebula 300+
• CWE-256

CityData CityChat ai.citydata.citychat credentials.json credentials storage

• CityData CityChat
• CWE-255
• CWE-256

Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage

• Albert Sağlık Hizmetleri ve Ticaret Albert Health
• CWE-255
• CWE-256

La Nacion App app.lanacion.activity BuildConfig.java credentials storage

• La Nacion App
• CWE-255
• CWE-256

BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage

• BabyChakra Pregnancy & Parenting App
• CWE-255
• CWE-256

XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage

• XREAL Nebula App
• CWE-255
• CWE-256

Plaintext password storage in Dell Device Management Agent (DDMA)

• Dell Device Management Agent (DDMA)
• CWE-256

An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.

• CWE-256

NocoDB has Plaintext Storage of Shared View Passwords

• CWE-256

<0.301.3 · fixed in 0.301.3

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

• Johnson Controls Frick Controls Quantum HD
• CWE-256

IBM Db2 Information Disclosure

• IBM Db2 for Linux, UNIX and Windows
• CWE-256

Plaintext password display in Quick.Cart

• OpenSolution Quick.Cart
• CWE-256

GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage

• GUnet OpenEclass
• CWE-256

Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)

• Brocade SANnav
• Information disclosure
• CWE-256

Plaintext password storage in Dell CloudBoost Virtual Appliance

• Dell CloudBoost Virtual Appliance
• CWE-256

AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password

• AutomationDirect CLICK Programmable Logic Controller
• CWE-256

Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload

• Ksenia Security S.p.A. lares
• CWE-256

ZKTeco BioTime Endpoint safe_setting credentials storage

• ZKTeco BioTime
• CWE-255
• CWE-256

Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database

• Beward R&D Co., Ltd BEWARD Intercom
• CWE-256