# CWE-260.

Every Advisory and CVE whose sources give the weakness CWE-260, newest first.

## Records, newest first

- [Improperly Stored Credentials](https://agentprime.io/advisories/CVE-2026-103548.md)
  `CVE-2026-103548` · CVE record: Itron MV-90 xi · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-257, CWE-260, CWE-261
- [Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal](https://agentprime.io/advisories/CVE-2019-25465.md)
  `CVE-2019-25465` · CVE record: Hisilicon HiIpcam · CVSS 8.7 High · Not analysed yet · Published 11 Mar 2026 · Tags: CWE-260
- [TaleLin Lin-CMS Tests Folder config.py password in configuration file](https://agentprime.io/advisories/CVE-2025-15151.md)
  `CVE-2025-15151` · CVE record: TaleLin Lin-CMS · CVSS 6.3 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: CWE-255, CWE-260
- [MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup Endpoint](https://agentprime.io/advisories/CVE-2023-53770.md)
  `CVE-2023-53770` · CVE record: MiniDVBLinux MiniDVBLinux(TM) Distribution (MLD) · CVSS 8.7 High · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-260
- [Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup Disclosure](https://agentprime.io/advisories/CVE-2023-53739.md)
  `CVE-2023-53739` · CVE record: Tinycontrol Tinycontrol LAN Controller v and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: CWE-260
- [IBM QRadar SIEM Information Disclosure](https://agentprime.io/advisories/CVE-2025-33119.md)
  `CVE-2025-33119` · CVE record: IBM QRadar Security Information and Event Management · CVSS 6.5 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: CWE-260
- [IBM Sterling B2B Integrator information disclosure](https://agentprime.io/advisories/CVE-2025-36002.md)
  `CVE-2025-36002` · CVE record: IBM Sterling B2B Integrator and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: CWE-256, CWE-260
- [IBM MQ information disclosure](https://agentprime.io/advisories/CVE-2025-36100.md)
  `CVE-2025-36100` · CVE record: IBM MQ · CVSS 5.1 Medium · Not analysed yet · Published 7 Sept 2025 · Tags: CWE-260
- [eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)](https://agentprime.io/advisories/CVE-2025-57754.md)
  `CVE-2025-57754` · CVE record: kristoferfannar eslint-ban-moment · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Aug 2025 · Tags: CWE-260
- [EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)).](https://agentprime.io/advisories/CVE-2025-51540.md)
  `CVE-2025-51540` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-260
- [BRAIN2 Configuration file for database access not sufficiently secured](https://agentprime.io/advisories/CVE-2025-6513.md)
  `CVE-2025-6513` · CVE record: Bizerba SE & Co. KG BRAIN2 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jun 2025 · Tags: CWE-260
- [IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure](https://agentprime.io/advisories/CVE-2025-25022.md)
  `CVE-2025-25022` · CVE record: IBM QRadar Suite Software and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Jun 2025 · Tags: CWE-260
- [IBM Sterling Partner Engagement Manager information disclosure](https://agentprime.io/advisories/CVE-2025-33093.md)
  `CVE-2025-33093` · CVE record: IBM Sterling Partner Engagement Manager · CVSS 7.5 High · Not analysed yet · Published 7 May 2025 · Tags: CWE-260
- [acme.sh: The Docker image from acme.sh before 40b6db6 is based on a…](https://agentprime.io/advisories/CVE-2025-32111.md)
  `CVE-2025-32111` · CVE record: acme.sh project acme.sh · CVSS 8.7 High · Not analysed yet · Published 4 Apr 2025 · Tags: CWE-260
- [IBM Security Verify Bridge information disclosure](https://agentprime.io/advisories/CVE-2024-45673.md)
  `CVE-2024-45673` · CVE record: IBM Security Verify Bridge Directory Sync · CVSS 5.5 Medium · Not analysed yet · Published 21 Feb 2025 · Tags: CWE-260
- [IBM Security Guardium Key Lifecycle Manager information disclosure](https://agentprime.io/advisories/CVE-2024-49817.md)
  `CVE-2024-49817` · CVE record: IBM Security Guardium Key Lifecycle Manager · CVSS 4.4 Medium · Not analysed yet · Published 17 Dec 2024 · Tags: CWE-260
- [Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file.](https://agentprime.io/advisories/CVE-2023-34128.md)
  `CVE-2023-34128` · CVE record: SonicWall GMS and 1 more · No CVSS score · Not analysed yet · Published 13 Jul 2023 · Tags: CWE-260
- [TOTOLINK N200RE Telnet Service custom.conf password in configuration file](https://agentprime.io/advisories/CVE-2023-2790.md)
  `CVE-2023-2790` · CVE record: TOTOLINK N200RE · CVSS 2.3 Low · Not analysed yet · Published 18 May 2023 · Tags: CWE-260
- [Password in config file in KIE server](https://agentprime.io/advisories/GHSA-pjw3-c74j-m9fj.md)
  `GHSA-pjw3-c74j-m9fj`, `CVE-2016-7043` · Maven `org.kie.server:kie-server-common`: affected `<7.21.0.Final`, fixed in `7.21.0.Final` · CVSS 5.9 Medium · Not analysed yet · Published 24 May 2022 · Tags: CWE-260
- [A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain root access of the de…](https://agentprime.io/advisories/CVE-2021-35033.md)
  `CVE-2021-35033` · CVE record: Zyxel NBG6818 series firmware and 4 more · CVSS 7.8 High · Not analysed yet · Published 23 Nov 2021 · Tags: CWE-260
- [MikroTik WinBox: MikroTik WinBox 3.22 and below stores the user's cleartext password in the…](https://agentprime.io/advisories/CVE-2020-5721.md)
  `CVE-2020-5721` · CVE record: MikroTik WinBox · No CVSS score · Not analysed yet · Published 15 Apr 2020 · Tags: CWE-260
- [Cloud Foundry Container Runtime Leaks IAAS Credentials](https://agentprime.io/advisories/CVE-2019-3780.md)
  `CVE-2019-3780` · CVE record: Cloud Foundry Cloud Foundry Container Runtime (CFCR) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Mar 2019 · Tags: CWE-260
- [A Password in Configuration File issue was discovered in Dahua DH-IPC-HDBW23A0RN-ZS, DH-IPC-HDBW13A0SN, DH-IPC-HDW1XXX, DH-IPC-HDW2XXX, DH-IPC-HDW4XXX, DH-IPC-HFW1XXX, DH-IPC-HFW2XXX, DH-IPC-HFW4XXX,…](https://agentprime.io/advisories/CVE-2017-7925.md)
  `CVE-2017-7925` · CVE record: Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras · No CVSS score · EPSS 0.51 · Not analysed yet · Published 6 May 2017 · Tags: CWE-260
- [A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS…](https://agentprime.io/advisories/CVE-2017-7923.md)
  `CVE-2017-7923` · CVE record: Hikvision Cameras · No CVSS score · Not analysed yet · Published 6 May 2017 · Tags: CWE-260
- [Hospira MedNet Password in Configuration File](https://agentprime.io/advisories/CVE-2014-5400.md)
  `CVE-2014-5400` · CVE record: Hospira MedNet · CVSS 6.8 Medium · Not analysed yet · Published 3 Apr 2015 · Tags: CWE-260

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-260>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-260/>. Everything for agents: <https://agentprime.io/llms.txt>.