# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Insecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh.](https://agentprime.io/advisories/CVE-2025-52364.md) `CVE-2025-52364` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [ColdFusion | Use of Hard-coded Credentials (CWE-798)](https://agentprime.io/advisories/CVE-2025-49551.md) `CVE-2025-49551` · CVE record: Adobe ColdFusion · CVSS 8.8 High · Not analysed yet · Published 8 Jul 2025 · Tags: Hard-coded credentials - [Hardcoded Credential Exposure Allows Unauthorized Access in Web Interface](https://agentprime.io/advisories/CVE-2025-37103.md) `CVE-2025-37103` · CVE record: Hewlett Packard Enterprise (HPE) HPE Networking Instant On · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded Password in SUR-FBD CMMS](https://agentprime.io/advisories/CVE-2025-3920.md) `CVE-2025-3920` · CVE record: SUR-FBD CMMS SUR-FBD CMMS · CVSS 8.5 High · Not analysed yet · Published 7 Jul 2025 · Tags: Hard-coded credentials - [Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite](https://agentprime.io/advisories/CVE-2025-24508.md) `CVE-2025-24508` · CVE record: Broadcom Symantec IT Management Suite · CVSS 6.4 Medium · Not analysed yet · Published 7 Jul 2025 · Tags: Hard-coded credentials - [A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6.](https://agentprime.io/advisories/CVE-2025-52492.md) `CVE-2025-52492` · CVE record · CVSS 7.5 High · Not analysed yet · Published 7 Jul 2025 · Tags: Hard-coded credentials - [Done-0 Jank JWT Token jwt_utils.go hard-coded password](https://agentprime.io/advisories/CVE-2025-7080.md) `CVE-2025-7080` · CVE record: Done-0 Jank · CVSS 6.3 Medium · Not analysed yet · Published 6 Jul 2025 · Tags: Hard-coded credentials, CWE-255 - [mao888 bluebell-plus JWT Token jwt.go hard-coded password](https://agentprime.io/advisories/CVE-2025-7079.md) `CVE-2025-7079` · CVE record: mao888 bluebell-plus · CVSS 6.3 Medium · Not analysed yet · Published 6 Jul 2025 · Tags: Hard-coded credentials, CWE-255 - [Hard Coded Key used for AES encryption](https://agentprime.io/advisories/CVE-2025-6071.md) `CVE-2025-6071` · CVE record: ABB RMC-100 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: Hard-coded credentials - [Authentication Bypass to the MQTT configuration Web Interface](https://agentprime.io/advisories/CVE-2025-6074.md) `CVE-2025-6074` · CVE record: ABB RMC-100 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: Hard-coded credentials - [NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface](https://agentprime.io/advisories/CVE-2025-34078.md) `CVE-2025-34078` · CVE record: NSClient++ NSClient++ · CVSS 7.3 High · Not analysed yet · Published 2 Jul 2025 · Tags: Hard-coded credentials - [Cisco Unified Communications Manager Static SSH Credentials Vulnerability](https://agentprime.io/advisories/CVE-2025-20309.md) `CVE-2025-20309` · CVE record: Cisco Cisco Unified Communications Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2025 · Tags: Hard-coded credentials - [ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.](https://agentprime.io/advisories/CVE-2025-45813.md) `CVE-2025-45813` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Jul 2025 · Tags: Hard-coded credentials - [OneLogin AD Connector API Credential and Signing Key Exposure](https://agentprime.io/advisories/CVE-2025-34062.md) `CVE-2025-34062` · CVE record: One Identity OneLogin Active Directory Connector (ADC) · CVSS 5.7 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Information disclosure, Hard-coded credentials - [Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read](https://agentprime.io/advisories/CVE-2025-34058.md) `CVE-2025-34058` · CVE record: Hangzhou Hikvision System Technology Streaming Media Management Server · CVSS 8.7 High · Not analysed yet · Published 1 Jul 2025 · Tags: Path traversal, Hard-coded credentials - [Pass-back attack in Konica Minolta bizhub 227 multifunctional printers](https://agentprime.io/advisories/CVE-2025-6081.md) `CVE-2025-6081` · CVE record: Konica Minolta bizhub 227 Multifunction printers · CVSS 6.8 Medium · Not analysed yet · Published 1 Jul 2025 · Tags: Hard-coded credentials - [D-Link DCS-7517 Qlync Password Generation httpd g_F_n_GenPassForQlync hard-coded password](https://agentprime.io/advisories/CVE-2025-6932.md) `CVE-2025-6932` · CVE record: D-Link DCS-7517 · CVSS 6.3 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: Hard-coded credentials, CWE-255 - [File Browser vulnerable to insecure password handling](https://agentprime.io/advisories/GHSA-cm2r-rg7r-p7gg.md) `GHSA-cm2r-rg7r-p7gg`, `CVE-2025-52997`, `GO-2025-3792` · Go `github.com/filebrowser/filebrowser` and 1 more: affected `<=1.11.0`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 30 Jun 2025 · Tags: Authentication bypass, Hard-coded credentials, CWE-1392 - [tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment](https://agentprime.io/advisories/GHSA-7mc2-6phr-23xc.md) `GHSA-7mc2-6phr-23xc`, `CVE-2024-49364` · npm `tiny-secp256k1`: affected `<1.1.7`, fixed in `1.1.7` · CVSS 8.1 High · Not analysed yet · Published 30 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded password in Flock Safety License Plate Reader](https://agentprime.io/advisories/CVE-2025-47823.md) `CVE-2025-47823` · CVE record: Flock Safety License Plate Reader · CVSS 2.2 Low · Not analysed yet · Published 27 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded password in Flock Safety Gunshot Detection devices](https://agentprime.io/advisories/CVE-2025-47821.md) `CVE-2025-47821` · CVE record: Flock Safety Gunshot Detection devices · CVSS 2.2 Low · Not analysed yet · Published 27 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded password in Flock Safety Gunshot Detection devices](https://agentprime.io/advisories/CVE-2025-47818.md) `CVE-2025-47818` · CVE record: Flock Safety Gunshot Detection devices · CVSS 2.2 Low · Not analysed yet · Published 27 Jun 2025 · Tags: Hard-coded credentials - [gooaclok819 sublinkX jwt.go hard-coded key](https://agentprime.io/advisories/CVE-2025-6669.md) `CVE-2025-6669` · CVE record: gooaclok819 sublinkX · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Hard-coded credentials, CWE-320 - [Authenticated disclosure of external service passwords via pass-back attack affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolt…](https://agentprime.io/advisories/CVE-2024-51984.md) `CVE-2024-51984` · CVE record: Brother Industries, Ltd HL-L8260CDN and 4 more · CVSS 6.8 Medium · Not analysed yet · Published 25 Jun 2025 · Tags: Hard-coded credentials - [Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.](https://agentprime.io/advisories/CVE-2024-51978.md) `CVE-2024-51978` · CVE record: Brother Industries, Ltd DCP-J928N-W/B and 4 more · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 25 Jun 2025 · Tags: Hard-coded credentials - [Hardcoded Credentials in Ataturk University's ATA-AOF Mobile Application](https://agentprime.io/advisories/CVE-2025-4378.md) `CVE-2025-4378` · CVE record: Ataturk University ATA-AOF Mobile Application · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials - [5VTechnologies Blue Angel Software Suite Hardcoded Credentials](https://agentprime.io/advisories/CVE-2025-34034.md) `CVE-2025-34034` · CVE record: 5VTechnologies Blue Angel Software Suite · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: Hard-coded credentials - [70mai M300 HTTP Server insufficiently protected credentials](https://agentprime.io/advisories/CVE-2025-6526.md) `CVE-2025-6526` · CVE record: 70mai M300 · CVSS 2.3 Low · Not analysed yet · Published 23 Jun 2025 · Tags: Hard-coded credentials - [D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials.](https://agentprime.io/advisories/CVE-2025-45784.md) `CVE-2025-45784` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Jun 2025 · Tags: Hard-coded credentials - [Sitecore XM and XP Hardcoded Credentials](https://agentprime.io/advisories/CVE-2025-34509.md) `CVE-2025-34509` · CVE record: Sitecore Experience Manager and 1 more · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.56 · Not analysed yet · Published 17 Jun 2025 · Tags: Hard-coded credentials - [TOTOLINK T10 shadow.sample hard-coded password](https://agentprime.io/advisories/CVE-2025-6139.md) `CVE-2025-6139` · CVE record: TOTOLINK T10 · CVSS 2.0 Low · Not analysed yet · Published 16 Jun 2025 · Tags: Hard-coded credentials, CWE-255 - [Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.](https://agentprime.io/advisories/PYSEC-2025-150.md) `PYSEC-2025-150`, `CVE-2025-28389` · PyPI `openc3`: affected `<=6.0.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jun 2025 · Tags: Hard-coded credentials - [OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.](https://agentprime.io/advisories/PYSEC-2025-258.md) `PYSEC-2025-258`, `CVE-2025-28388` · PyPI `openc3`: affected `<=6.0.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jun 2025 · Tags: Hard-coded credentials - [mySCADA PRO Manager Password Disclosure](https://agentprime.io/advisories/CVE-2025-35941.md) `CVE-2025-35941` · CVE record: mySCADA myPRO · CVSS 5.5 Medium · Not analysed yet · Published 11 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded ArchiverSpaApi JWT Signing Key](https://agentprime.io/advisories/CVE-2025-35940.md) `CVE-2025-35940` · CVE record: GFI Archiver · CVSS 8.1 High · Not analysed yet · Published 10 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Ivanti Workspace Control](https://agentprime.io/advisories/CVE-2025-5353.md) `CVE-2025-5353` · CVE record: Ivanti Workspace Control · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Ivanti Workspace Control](https://agentprime.io/advisories/CVE-2025-22463.md) `CVE-2025-22463` · CVE record: Ivanti Workspace Control · CVSS 7.3 High · Not analysed yet · Published 10 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Ivanti Workspace Control](https://agentprime.io/advisories/CVE-2025-22455.md) `CVE-2025-22455` · CVE record: Ivanti Workspace Control · CVSS 8.8 High · Not analysed yet · Published 10 Jun 2025 · Tags: Hard-coded credentials - [CyberData 011209 SIP Emergency Intercom Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2025-30183.md) `CVE-2025-30183` · CVE record: CyberData 011209 SIP Emergency Intercom · CVSS 8.7 High · Not analysed yet · Published 9 Jun 2025 · Tags: Hard-coded credentials - [Requests vulnerable to .netrc credentials leak via malicious URLs](https://agentprime.io/advisories/GHSA-9hjg-9r4m-mvj7.md) `GHSA-9hjg-9r4m-mvj7`, `CVE-2024-47081`, `PYSEC-2026-1872` · PyPI `requests`: affected `<2.32.4`, fixed in `2.32.4` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2025 · Tags: Hard-coded credentials - [WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability](https://agentprime.io/advisories/CVE-2025-5751.md) `CVE-2025-5751` · CVE record: WOLFBOX Level 2 EV Charger · CVSS 4.6 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Hard-coded credentials - [Use of Hard-coded Credentials in OnlineSuite](https://agentprime.io/advisories/CVE-2025-3321.md) `CVE-2025-3321` · CVE record: B. Braun Melsungen AG OnlineSuite · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2025 · Tags: Hard-coded credentials - [IBM Security Verify Governance information disclosure](https://agentprime.io/advisories/CVE-2024-22330.md) `CVE-2024-22330` · CVE record: IBM Security Verify Governance · CVSS 5.9 Medium · Not analysed yet · Published 6 Jun 2025 · Tags: Hard-coded credentials - [ISE on AWS Static Credential](https://agentprime.io/advisories/CVE-2025-20286.md) `CVE-2025-20286` · CVE record: Cisco Cisco Identity Services Engine Software · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Jun 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Arris VIP1113](https://agentprime.io/advisories/CVE-2025-49164.md) `CVE-2025-49164` · CVE record: Arris VIP1113 · CVSS 4.3 Medium · Not analysed yet · Published 2 Jun 2025 · Tags: Hard-coded credentials - [NuCom NC-WR744G Console Application hard-coded credentials](https://agentprime.io/advisories/CVE-2025-5379.md) `CVE-2025-5379` · CVE record: NuCom NC-WR744G · CVSS 5.3 Medium · Not analysed yet · Published 31 May 2025 · Tags: Hard-coded credentials - [Default Credentials](https://agentprime.io/advisories/CVE-2025-4633.md) `CVE-2025-4633` · CVE record: JCT Airpointer · CVSS 6.5 Medium · Not analysed yet · Published 30 May 2025 · Tags: Hard-coded credentials - [Project AI API Key Exposure in Source Code](https://agentprime.io/advisories/CVE-2025-48491.md) `CVE-2025-48491` · CVE record: aryan6673 project-ai · CVSS 2.7 Low · Not analysed yet · Published 30 May 2025 · Tags: Hard-coded credentials - [Consilium Safety CS5000 Fire Panel Use of Hard-coded Credentials](https://agentprime.io/advisories/CVE-2025-46352.md) `CVE-2025-46352` · CVE record: Consilium Safety CS5000 Fire Panel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: Hard-coded credentials - [ActiveMQ Artemis AMQ Broker Operator Starting Credentials Reuse in github.com/arkmq-org/activemq-artemis-operator](https://agentprime.io/advisories/GHSA-q5q7-8x6x-hcg2.md) `GHSA-q5q7-8x6x-hcg2`, `CVE-2025-4057`, `GO-2025-3717` · Go `github.com/arkmq-org/activemq-artemis-operator`: affected `*`, no fixed version yet · CVSS 5.5 Medium · Not analysed yet · Published 29 May 2025 · Tags: Hard-coded credentials - [Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.](https://agentprime.io/advisories/CVE-2025-48748.md) `CVE-2025-48748` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 May 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Dell PowerStore](https://agentprime.io/advisories/CVE-2025-36572.md) `CVE-2025-36572` · CVE record: Dell PowerStore · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2025 · Tags: Hard-coded credentials - [Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.](https://agentprime.io/advisories/CVE-2025-47748.md) `CVE-2025-47748` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 28 May 2025 · Tags: Hard-coded credentials - [PerfreeBlog JWT JwtUtil hard-coded key](https://agentprime.io/advisories/CVE-2025-5164.md) `CVE-2025-5164` · CVE record: PerfreeBlog · CVSS 6.3 Medium · Not analysed yet · Published 26 May 2025 · Tags: Hard-coded credentials, CWE-320 - [Injection vulnerability in Iridium Certus 700](https://agentprime.io/advisories/CVE-2025-41380.md) `CVE-2025-41380` · CVE record: Intellian Technologies Iridium Certus 700 · CVSS 6.1 Medium · Not analysed yet · Published 23 May 2025 · Tags: Hard-coded credentials - [Disclosure of Alibaba (OSS) Keys In Ecovacs Home Android and iOS Mobile Applications](https://agentprime.io/advisories/CVE-2025-2394.md) `CVE-2025-2394` · CVE record: Ecovacs Ecovacs Mobile and Android Application · CVSS 4.7 Medium · Not analysed yet · Published 23 May 2025 · Tags: Hard-coded credentials - [Schule Has Insecure OTP Length, is Susceptible to Brute-Force Attacks](https://agentprime.io/advisories/CVE-2025-48372.md) `CVE-2025-48372` · CVE record: schule111 Schule · CVSS 6.6 Medium · Not analysed yet · Published 22 May 2025 · Tags: Hard-coded credentials - [MedDream WEB DICOM Viewer Cleartext Transmission of Credentials Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2025-3480.md) `CVE-2025-3480` · CVE record: MedDream WEB DICOM Viewer · CVSS 5.3 Medium · Not analysed yet · Published 22 May 2025 · Tags: Hard-coded credentials - [Hard-Coded Certificate and Private Key for HTTPS Web Interface in eCharge Hardy Barth cPH2 / cPP2 charging stations](https://agentprime.io/advisories/CVE-2025-48417.md) `CVE-2025-48417` · CVE record: eCharge Hardy Barth cPH2 / cPP2 charging stations · CVSS 6.5 Medium · Not analysed yet · Published 21 May 2025 · Tags: Hard-coded credentials - [Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations](https://agentprime.io/advisories/CVE-2025-48414.md) `CVE-2025-48414` · CVE record: eCharge Hardy Barth cPH2 / cPP2 charging stations · CVSS 6.5 Medium · Not analysed yet · Published 21 May 2025 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .