# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [CVE-2025-6077](https://agentprime.io/advisories/CVE-2025-6077.md) `CVE-2025-6077` · CVE record: Partner Software Partner Web · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Aug 2025 · Tags: Hard-coded credentials - [Weak password requirements in Quantum SuperLoader](https://agentprime.io/advisories/CVE-2019-19145.md) `CVE-2019-19145` · CVE record: Quantum SuperLoader · CVSS 5.8 Medium · Not analysed yet · Published 1 Aug 2025 · Tags: Hard-coded credentials - [Hard-Coded Encryption Keys found in System](https://agentprime.io/advisories/CVE-2025-37112.md) `CVE-2025-37112` · CVE record: Hewlett Packard Enterprise HPE Telco Network Function Virtual Orchestrator · CVSS 6.0 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Hard-coded credentials - [Hard-Coded Authentication Keys found in System](https://agentprime.io/advisories/CVE-2025-37111.md) `CVE-2025-37111` · CVE record: Hewlett Packard Enterprise HPE Telco Network Function Virtual Orchestrator · CVSS 6.0 Medium · Not analysed yet · Published 31 Jul 2025 · Tags: Hard-coded credentials - [Array Networks vAPV and vxAG Default Credential Privilege Escalation](https://agentprime.io/advisories/CVE-2014-125121.md) `CVE-2014-125121` · CVE record: Array Networks vAPV and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Jul 2025 · Tags: Broken access control, Hard-coded credentials - [Weak credentials in ZTE Japan. K.K. ZXHN-F660T and others](https://agentprime.io/advisories/CVE-2025-53558.md) `CVE-2025-53558` · CVE record: ZTE Japan. K.K. ZXHN-F660T and 1 more · CVSS 8.7 High · Not analysed yet · Published 31 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded password in Dell SmartFabric OS10 Software](https://agentprime.io/advisories/CVE-2025-36609.md) `CVE-2025-36609` · CVE record: Dell SmartFabric OS10 Software · CVSS 2.5 Low · Not analysed yet · Published 30 Jul 2025 · Tags: Hard-coded credentials - [GLPI's MailCollector Receiver is vulnerable to credential exfiltration](https://agentprime.io/advisories/CVE-2025-53008.md) `CVE-2025-53008` · CVE record: glpi-project glpi · CVSS 6.5 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Hard-coded credentials - [Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server](https://agentprime.io/advisories/GHSA-4fwj-8595-wp25.md) `GHSA-4fwj-8595-wp25`, `CVE-2025-6227`, `GO-2025-3818` · Go `github.com/mattermost/mattermost-server` and 3 more: affected `>=9.11.0+incompatible, <9.11.17+incompatible || >=10.5.0+incompatible, <10.5.8+incompatible`, fixed in `9.11.17+incompatible`, `10.5.8+incompatible` · CVSS 2.2 Low · Not analysed yet · Published 29 Jul 2025 · Tags: Hard-coded credentials - [Retrievable password hash protecting TSplus admin console](https://agentprime.io/advisories/CVE-2025-5922.md) `CVE-2025-5922` · CVE record: TSplus TSplus Remote Access · CVSS 4.8 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Hard-coded credentials, CWE-759 - [Sandboxie exposes encrypted sandbox key during password change](https://agentprime.io/advisories/CVE-2025-54422.md) `CVE-2025-54422` · CVE record: sandboxie-plus Sandboxie · CVSS 6.9 Medium · Not analysed yet · Published 29 Jul 2025 · Tags: Information disclosure, Hard-coded credentials, CWE-322 - [RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)](https://agentprime.io/advisories/CVE-2025-54428.md) `CVE-2025-54428` · CVE record: musombi123 RevelaCode-Backend · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2025 · Tags: Hard-coded credentials - [An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices.](https://agentprime.io/advisories/CVE-2025-30125.md) `CVE-2025-30125` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Jul 2025 · Tags: Hard-coded credentials - [D-Link DIR-890L UART Port rgbin hard-coded credentials](https://agentprime.io/advisories/CVE-2025-8231.md) `CVE-2025-8231` · CVE record: D-Link DIR-890L · CVSS 7.0 High · Not analysed yet · Published 27 Jul 2025 · Tags: Hard-coded credentials - [Tenda AC18 Samba smb.conf weak password](https://agentprime.io/advisories/CVE-2025-8182.md) `CVE-2025-8182` · CVE record: Tenda AC18 · CVSS 6.3 Medium · Not analysed yet · Published 26 Jul 2025 · Tags: Hard-coded credentials - [Opencast still publishes global system account credentials](https://agentprime.io/advisories/GHSA-j63h-hmgw-x4j7.md) `GHSA-j63h-hmgw-x4j7`, `CVE-2025-54380` · Maven `org.opencastproject:opencast-common` and 3 more: affected `<17.6`, fixed in `17.6` · CVSS 6.5 Medium · Not analysed yet · Published 25 Jul 2025 · Tags: Information disclosure, Hard-coded credentials - [Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read](https://agentprime.io/advisories/CVE-2025-34139.md) `CVE-2025-34139` · CVE record: Sitecore Experience Manager (XM) and 3 more · CVSS 8.7 High · Not analysed yet · Published 25 Jul 2025 · Tags: Hard-coded credentials, Information disclosure - [Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE](https://agentprime.io/advisories/CVE-2014-125115.md) `CVE-2014-125115` · CVE record: Artica ST Pandora FMS · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Jul 2025 · Tags: SQL injection, Hard-coded credentials - [Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.](https://agentprime.io/advisories/CVE-2025-45466.md) `CVE-2025-45466` · CVE record · CVSS 8.8 High · Not analysed yet · Published 25 Jul 2025 · Tags: Hard-coded credentials - [HCL iAutomate is affected by hardcoded credentials](https://agentprime.io/advisories/CVE-2025-31953.md) `CVE-2025-31953` · CVE record: HCL Software iAutomate · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Samsung Electronics MagicINFO 9 Server](https://agentprime.io/advisories/CVE-2025-54455.md) `CVE-2025-54455` · CVE record: Samsung Electronics MagicINFO 9 Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Samsung Electronics MagicINFO 9 Server](https://agentprime.io/advisories/CVE-2025-54454.md) `CVE-2025-54454` · CVE record: Samsung Electronics MagicINFO 9 Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2025 · Tags: Hard-coded credentials - [Poly Clariti Manager - Multiple Security Vulnerabilities](https://agentprime.io/advisories/CVE-2025-43483.md) `CVE-2025-43483` · CVE record: HP Inc. Poly Clariti Manager · CVSS 5.9 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Hard-coded credentials - [Weak credentials in Devolutions Server](https://agentprime.io/advisories/CVE-2025-6523.md) `CVE-2025-6523` · CVE record: Devolutions Server · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Hard-coded credentials - [Hardcoded Credentials in PAVO Inc.'s PAVO Pay](https://agentprime.io/advisories/CVE-2025-4130.md) `CVE-2025-4130` · CVE record: PAVO Inc. PAVO Pay · CVSS 7.5 High · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in MyASUS](https://agentprime.io/advisories/CVE-2025-4570.md) `CVE-2025-4570` · CVE record: ASUS MyASUS · CVSS 6.9 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in MyASUS](https://agentprime.io/advisories/CVE-2025-4569.md) `CVE-2025-4569` · CVE record: ASUS MyASUS · CVSS 7.7 High · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Hardcoded SQLite password in FARA](https://agentprime.io/advisories/CVE-2025-4049.md) `CVE-2025-4049` · CVE record: SIGNUM-NET FARA · CVSS 8.6 High · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServ…](https://agentprime.io/advisories/CVE-2025-52374.md) `CVE-2025-52374` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.](https://agentprime.io/advisories/CVE-2025-52373.md) `CVE-2025-52373` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 21 Jul 2025 · Tags: Hard-coded credentials - [Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5](https://agentprime.io/advisories/CVE-2025-6982.md) `CVE-2025-6982` · CVE record: TP-Link Systems Inc. Archer C50 V3 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router](https://agentprime.io/advisories/CVE-2025-53754.md) `CVE-2025-53754` · CVE record: Digisol XPON ONU Wi-Fi Router (DG-GR6821AC) · CVSS 5.1 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in ZEXELON CO., LTD. ZWX-2000CSW2-HN and others](https://agentprime.io/advisories/CVE-2025-53842.md) `CVE-2025-53842` · CVE record: ZEXELON CO., LTD. ZWX-2000CSW2-HN and 1 more · CVSS 6.8 Medium · Not analysed yet · Published 16 Jul 2025 · Tags: Hard-coded credentials - [Remote Code Execution in ProTNS ActADUR](https://agentprime.io/advisories/CVE-2025-3621.md) `CVE-2025-3621` · CVE record: ProTNS ActADUR · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Jul 2025 · Tags: Command injection, Authentication bypass, Hard-coded credentials, CWE-1327 - [An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet…](https://agentprime.io/advisories/CVE-2025-52376.md) `CVE-2025-52376` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 15 Jul 2025 · Tags: Authentication bypass, Hard-coded credentials - [Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded password](https://agentprime.io/advisories/CVE-2025-7577.md) `CVE-2025-7577` · CVE record: Teledyne FLIR FB-Series O and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2025 · Tags: Hard-coded credentials, CWE-255 - [LB-LINK BL-AC3600 shadow hard-coded credentials](https://agentprime.io/advisories/CVE-2025-7564.md) `CVE-2025-7564` · CVE record: LB-LINK BL-AC3600 · CVSS 8.5 High · Not analysed yet · Published 14 Jul 2025 · Tags: Hard-coded credentials - [Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-.](https://agentprime.io/advisories/CVE-2025-52363.md) `CVE-2025-52363` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 14 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Ivanti DSM](https://agentprime.io/advisories/CVE-2024-38648.md) `CVE-2024-38648` · CVE record: Ivanti DSM · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Jul 2025 · Tags: Hard-coded credentials - [ZPan Uses Hard-Coded Password](https://agentprime.io/advisories/GHSA-2hfh-94w5-wxvf.md) `GHSA-2hfh-94w5-wxvf`, `CVE-2025-7453`, `GO-2026-6014` · Go `github.com/saltbo/zpan`: affected `<1.6.6`, fixed in `1.6.6` · CVSS 6.3 Medium · Not analysed yet · Published 11 Jul 2025 · Tags: Hard-coded credentials, CWE-255 - [Hard-coded credentials in Shenzhen Liandian Communication Technology LTD V380 IP Camera / AppFHE1_V1.0.6.0](https://agentprime.io/advisories/CVE-2025-7503.md) `CVE-2025-7503` · CVE record: Shenzhen Liandian Communication Technology LTD V380 IP Camera / AppFHE1_V1.0.6.0 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jul 2025 · Tags: Hard-coded credentials - [Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php](https://agentprime.io/advisories/CVE-2025-7401.md) `CVE-2025-7401` · CVE record: aa-team Premium Age Verification / Restriction for WordPress · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Jul 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Mitsubishi Electric Corporation PV-DR004J and others](https://agentprime.io/advisories/CVE-2025-5023.md) `CVE-2025-5023` · CVE record: Mitsubishi Electric Corporation PV-DR004J and 1 more · CVSS 7.1 High · Not analysed yet · Published 10 Jul 2025 · Tags: Hard-coded credentials - [Weak password requirements in Mitsubishi Electric Corporation PV-DR004J and others](https://agentprime.io/advisories/CVE-2025-5022.md) `CVE-2025-5022` · CVE record: Mitsubishi Electric Corporation PV-DR004J and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Jul 2025 · Tags: Hard-coded credentials - [Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form](https://agentprime.io/advisories/GHSA-jmrv-rxgr-phvr.md) `GHSA-jmrv-rxgr-phvr`, `CVE-2025-53743` · Maven `org.jenkins-ci.plugins:applitools-eyes`: affected `<=1.16.5`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form](https://agentprime.io/advisories/GHSA-8gp3-m447-gw2v.md) `GHSA-8gp3-m447-gw2v`, `CVE-2025-53669` · Maven `org.jenkins-ci.plugins:vaddy-plugin`: affected `<=1.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets](https://agentprime.io/advisories/GHSA-r496-x769-f8j4.md) `GHSA-r496-x769-f8j4`, `CVE-2025-53657` · Maven `org.jenkins-ci.plugins:soapui-pro-functional-testing`: affected `<=1.11`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-q8p4-vw42-66gh.md) `GHSA-q8p4-vw42-66gh`, `CVE-2025-53664` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens](https://agentprime.io/advisories/GHSA-pgrx-5f8q-r5mq.md) `GHSA-pgrx-5f8q-r5mq`, `CVE-2025-53663` · Maven `com.ibm.devops:ibm-cloud-devops`: affected `<=2.0.16`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials - [Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens](https://agentprime.io/advisories/GHSA-m248-72rh-cpx4.md) `GHSA-m248-72rh-cpx4`, `CVE-2025-53667` · Maven `org.jenkins-ci.plugins:deadmanssnitch`: affected `<=0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys](https://agentprime.io/advisories/GHSA-jxwj-qccf-4896.md) `GHSA-jxwj-qccf-4896`, `CVE-2025-53662` · Maven `org.jenkins-ci.plugins:ifttt-build-notifier`: affected `<=1.2`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins QMetry Test Management Plugin vulnerability exposes API keys](https://agentprime.io/advisories/GHSA-962q-84v8-hxhj.md) `GHSA-962q-84v8-hxhj`, `CVE-2025-53660` · Maven `org.jenkins-ci.plugins:qmetry-test-management`: affected `<=1.13`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form](https://agentprime.io/advisories/GHSA-8wp4-r84g-gcmw.md) `GHSA-8wp4-r84g-gcmw`, `CVE-2025-53661` · Maven `io.jenkins.plugins:testsigma`: affected `<=1.6`, no fixed version yet · CVSS 3.1 Low · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials](https://agentprime.io/advisories/GHSA-884f-p57j-f258.md) `GHSA-884f-p57j-f258`, `CVE-2025-53656` · Maven `org.jenkins-ci.plugins:soapui-pro-functional-testing`: affected `<=1.11`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text](https://agentprime.io/advisories/GHSA-5pcv-7v3q-hw8j.md) `GHSA-5pcv-7v3q-hw8j`, `CVE-2025-53666` · Maven `org.jenkins-ci.plugins:deadmanssnitch`: affected `<=0.1`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials - [Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form](https://agentprime.io/advisories/GHSA-4v4v-92cx-x4f4.md) `GHSA-4v4v-92cx-x4f4`, `CVE-2025-53671` · Maven `org.jenkins-ci.plugins:nouvola-divecloud`: affected `<=1.08`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens](https://agentprime.io/advisories/GHSA-28j3-hphh-cjr8.md) `GHSA-28j3-hphh-cjr8`, `CVE-2025-53665` · Maven `com.apica:ApicaLoadtest`: affected `<=1.10`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-256 - [Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens](https://agentprime.io/advisories/GHSA-3wgg-3j4j-3f69.md) `GHSA-3wgg-3j4j-3f69`, `CVE-2025-53653` · Maven `org.jenkins-ci.plugins:aqua-security-scanner`: affected `<=3.2.8`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Weak cryptography or TLS, Hard-coded credentials - [Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key](https://agentprime.io/advisories/GHSA-3c9f-c64m-h4wc.md) `GHSA-3c9f-c64m-h4wc`, `CVE-2025-53654` · Maven `org.jenkins.plugins.statistics.gatherer:statistics-gatherer`: affected `<=2.0.3`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials - [Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages](https://agentprime.io/advisories/GHSA-9768-hprv-crj5.md) `GHSA-9768-hprv-crj5`, `CVE-2025-53650` · Maven `org.jenkins-ci.plugins:credentials-binding`: affected `<687.689.v1a`, fixed in `687.689.v1a` · CVSS 4.3 Medium · Not analysed yet · Published 9 Jul 2025 · Tags: Hard-coded credentials, CWE-779 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .