# Hard-coded credentials. Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Newforma Info Exchange (NIX) shared hard-coded secret key](https://agentprime.io/advisories/CVE-2025-35052.md) `CVE-2025-35052` · CVE record: Newforma Project Center · CVSS 6.3 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Hard-coded credentials - [Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org](https://agentprime.io/advisories/CVE-2025-61776.md) `CVE-2025-61776` · CVE record: DependencyTrack dependency-track · CVSS 4.7 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Hard-coded credentials - [Kibana Insufficiently Protected Credentials in the CrowdStrike Connector](https://agentprime.io/advisories/CVE-2025-37728.md) `CVE-2025-37728` · CVE record: Elastic Kibana · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2025 · Tags: Hard-coded credentials - [NovoSGA: Manipulation of User Creation Page can lead to weak password requirements](https://agentprime.io/advisories/GHSA-xgr2-5837-hf48.md) `GHSA-xgr2-5837-hf48`, `CVE-2025-11322`, `PKSA-3wc8-k4ky-rszh` · Packagist `novosga/novosga`: affected `<=2.2.12`, no fixed version yet · CVSS 6.3 Medium · Not analysed yet · Published 6 Oct 2025 · Tags: Hard-coded credentials - [CRMEB JWT HMAC Secret hard-coded key](https://agentprime.io/advisories/CVE-2025-11290.md) `CVE-2025-11290` · CVE record: CRMEB · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Hard-coded credentials, CWE-320 - [Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password](https://agentprime.io/advisories/CVE-2025-11284.md) `CVE-2025-11284` · CVE record: Zytec Dalian Zhuoyun Technology Central Authentication Service · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2025 · Tags: Hard-coded credentials, CWE-255 - [Hardcoded Credentials in Logo Software's TigerWings ERP](https://agentprime.io/advisories/CVE-2025-10609.md) `CVE-2025-10609` · CVE record: Logo Software Inc. TigerWings ERP · CVSS 5.9 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Hard-coded credentials - [LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin](https://agentprime.io/advisories/CVE-2025-27231.md) `CVE-2025-27231` · CVE record: Zabbix Zabbix · CVSS 4.3 Medium · Not analysed yet · Published 3 Oct 2025 · Tags: Hard-coded credentials - [Hard-coded Credentials in PosCube's Assist](https://agentprime.io/advisories/CVE-2025-0642.md) `CVE-2025-0642` · CVE record: PosCube Hardware Software and Consulting Ltd. Co. Assist · CVSS 6.3 Medium · Not analysed yet · Published 2 Oct 2025 · Tags: Broken access control, Hard-coded credentials - [The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falcon and Sparrow License Plate Readers and Bravo Edge AI Compute Devices) bundles…](https://agentprime.io/advisories/CVE-2025-59407.md) `CVE-2025-59407` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2025 · Tags: Hard-coded credentials - [IBM Transformation Extender Advanced information disclosure](https://agentprime.io/advisories/CVE-2023-49883.md) `CVE-2023-49883` · CVE record: IBM Transformation Extender Advanced · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2025 · Tags: Hard-coded credentials - [Keysight Ixia Vision Product Family Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-24525.md) `CVE-2025-24525` · CVE record: Keysight Ixia Vision Product Family · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Undocumented Hardcoded SSH Key](https://agentprime.io/advisories/CVE-2025-34217.md) `CVE-2025-34217` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2025 · Tags: Hard-coded credentials - [Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution](https://agentprime.io/advisories/CVE-2025-8625.md) `CVE-2025-8625` · CVE record: copypressdev Copypress Rest API · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Unauthenticated Firmware Update Endpoint RCE](https://agentprime.io/advisories/CVE-2025-34215.md) `CVE-2025-34215` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Insecure SSH Client Configuration](https://agentprime.io/advisories/CVE-2025-34207.md) `CVE-2025-34207` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 7.9 High · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Insecure Installation Credentials](https://agentprime.io/advisories/CVE-2025-34223.md) `CVE-2025-34223` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Authentication bypass, Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private Keys](https://agentprime.io/advisories/CVE-2025-34211.md) `CVE-2025-34211` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key](https://agentprime.io/advisories/CVE-2025-34209.md) `CVE-2025-34209` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Hardcoded Encryption Private Keys](https://agentprime.io/advisories/CVE-2025-34234.md) `CVE-2025-34234` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Hardcoded PrinterLogic CA Private Key and Hardcoded Password](https://agentprime.io/advisories/CVE-2025-34196.md) `CVE-2025-34196` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Hard-coded credentials - [Apeman ID71 system.ini hard-coded credentials](https://agentprime.io/advisories/CVE-2025-11126.md) `CVE-2025-11126` · CVE record: Apeman ID71 · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2025 · Tags: Hard-coded credentials - [IBM Controller information disclosure](https://agentprime.io/advisories/CVE-2025-36326.md) `CVE-2025-36326` · CVE record: IBM Cognos Controller and 1 more · CVSS 3.7 Low · Not analysed yet · Published 26 Sept 2025 · Tags: Hard-coded credentials - [Hard-coded cryptographic key in Unitree Go2 and others](https://agentprime.io/advisories/CVE-2025-60250.md) `CVE-2025-60250` · CVE record: Unitree Go2 and 3 more · CVSS 4.7 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Hard-coded credentials - [In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).](https://agentprime.io/advisories/CVE-2025-58385.md) `CVE-2025-58385` · CVE record · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2025 · Tags: Hard-coded credentials - [Insufficiently Protected Credentials in Dingtian DT-R002](https://agentprime.io/advisories/CVE-2025-10880.md) `CVE-2025-10880` · CVE record: Dingtian DT-R002 · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2025 · Tags: Hard-coded credentials - [Insufficiently Protected Credentials in Dingtian DT-R002](https://agentprime.io/advisories/CVE-2025-10879.md) `CVE-2025-10879` · CVE record: Dingtian DT-R002 · CVSS 8.7 High · Not analysed yet · Published 25 Sept 2025 · Tags: Hard-coded credentials - [Ericsson Indoor Connect 8855 - Insufficiently Protected Credentials Vulnerability](https://agentprime.io/advisories/CVE-2025-40838.md) `CVE-2025-40838` · CVE record: Ericsson Indoor Connect 8855 · CVSS 5.1 Medium · Not analysed yet · Published 25 Sept 2025 · Tags: Hard-coded credentials - [Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5](https://agentprime.io/advisories/CVE-2025-10360.md) `CVE-2025-10360` · CVE record: Perforce Puppet Enterprise · CVSS 6.9 Medium · Not analysed yet · Published 24 Sept 2025 · Tags: Hard-coded credentials - [AutomationDirect CLICK PLUS Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-58069.md) `CVE-2025-58069` · CVE record: AutomationDirect CLICK PLUS C0-0x CPU firmware and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: Hard-coded credentials - [Weak Authentication for Root User](https://agentprime.io/advisories/CVE-2025-9964.md) `CVE-2025-9964` · CVE record: Novakon P series (P07, P10, P12, P15) · CVSS 8.6 High · Not analysed yet · Published 23 Sept 2025 · Tags: Hard-coded credentials - [WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability](https://agentprime.io/advisories/CVE-2025-58269.md) `CVE-2025-58269` · CVE record: weDevs WP Project Manager · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Hard-coded credentials - [WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure Vulnerability](https://agentprime.io/advisories/CVE-2025-58656.md) `CVE-2025-58656` · CVE record: Risto Niinemets Estonian Shipping Methods for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Hard-coded credentials - [WordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2025-58659.md) `CVE-2025-58659` · CVE record: Essekia Helpie FAQ · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2025 · Tags: Hard-coded credentials - [Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authenticate to the clo…](https://agentprime.io/advisories/CVE-2025-57602.md) `CVE-2025-57602` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2025 · Tags: Hard-coded credentials - [AiKaan Cloud Controller uses a single hardcoded SSH private key and the username \`proxyuser\` for remote terminal access to all managed IoT/edge devices.](https://agentprime.io/advisories/CVE-2025-57601.md) `CVE-2025-57601` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Sept 2025 · Tags: Hard-coded credentials - [Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation.](https://agentprime.io/advisories/CVE-2025-57434.md) `CVE-2025-57434` · CVE record · CVSS 8.8 High · Not analysed yet · Published 22 Sept 2025 · Tags: Authentication bypass, Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Shared / Hardcoded SSH Host Private Keys in Appliance Image](https://agentprime.io/advisories/CVE-2025-34198.md) `CVE-2025-34198` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Sept 2025 · Tags: Hard-coded credentials - [Vasion Print (formerly PrinterLogic) Undocumented Local Account with Hardcoded Password and Passwordless sudo](https://agentprime.io/advisories/CVE-2025-34197.md) `CVE-2025-34197` · CVE record: Vasion Print Virtual Appliance Host and 1 more · CVSS 8.6 High · Not analysed yet · Published 19 Sept 2025 · Tags: Hard-coded credentials - [Hardcoded credentials in default configuration of PPress 0.0.9.](https://agentprime.io/advisories/CVE-2025-52159.md) `CVE-2025-52159` · CVE record · CVSS 8.8 High · Not analysed yet · Published 19 Sept 2025 · Tags: Hard-coded credentials - [Cognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded Password](https://agentprime.io/advisories/CVE-2025-54754.md) `CVE-2025-54754` · CVE record: Cognex In-Sight 2000 series and 4 more · CVSS 8.6 High · Not analysed yet · Published 18 Sept 2025 · Tags: Hard-coded credentials - [Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak Credentials](https://agentprime.io/advisories/CVE-2025-30519.md) `CVE-2025-30519` · CVE record: Dover Fueling Solutions ProGauge MagLink LX 4 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2025 · Tags: Hard-coded credentials - [Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-54807.md) `CVE-2025-54807` · CVE record: Dover Fueling Solutions ProGauge MagLink LX 4 and 2 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Sept 2025 · Tags: Hard-coded credentials - [H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials.](https://agentprime.io/advisories/CVE-2025-57295.md) `CVE-2025-57295` · CVE record · CVSS 8.0 High · Not analysed yet · Published 18 Sept 2025 · Tags: Hard-coded credentials, CWE-1188 - [Hardcoded passwords](https://agentprime.io/advisories/CVE-2024-48842.md) `CVE-2024-48842` · CVE record: ABB FLXEON · CVSS 7.3 High · Not analysed yet · Published 17 Sept 2025 · Tags: Hard-coded credentials - [BMC Control-M/Agent hardcoded Blowfish keys](https://agentprime.io/advisories/CVE-2025-55112.md) `CVE-2025-55112` · CVE record: BMC Control-M/Agent · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2025 · Tags: Hard-coded credentials, Weak cryptography or TLS - [An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previous versions.](https://agentprime.io/advisories/CVE-2025-57174.md) `CVE-2025-57174` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2025 · Tags: Hard-coded credentials - [iteachyou Dreamer CMS updatePwd weak password](https://agentprime.io/advisories/CVE-2025-10320.md) `CVE-2025-10320` · CVE record: iteachyou Dreamer CMS · CVSS 2.3 Low · Not analysed yet · Published 12 Sept 2025 · Tags: Hard-coded credentials - [An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password](https://agentprime.io/advisories/CVE-2025-57579.md) `CVE-2025-57579` · CVE record · CVSS 8.0 High · Not analysed yet · Published 12 Sept 2025 · Tags: Hard-coded credentials - [An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password](https://agentprime.io/advisories/CVE-2025-57578.md) `CVE-2025-57578` · CVE record · CVSS 8.0 High · Not analysed yet · Published 12 Sept 2025 · Tags: Hard-coded credentials - [An issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password.](https://agentprime.io/advisories/CVE-2025-57577.md) `CVE-2025-57577` · CVE record · CVSS 8.0 High · Not analysed yet · Published 12 Sept 2025 · Tags: Hard-coded credentials - [DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key](https://agentprime.io/advisories/CVE-2025-10250.md) `CVE-2025-10250` · CVE record: DJI Mavic Spark and 2 more · CVSS 2.3 Low · Not analysed yet · Published 11 Sept 2025 · Tags: Hard-coded credentials, CWE-320 - [BeyondCart Connector <= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter](https://agentprime.io/advisories/CVE-2025-8570.md) `CVE-2025-8570` · CVE record: beyondcart BeyondCart Connector · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Sept 2025 · Tags: Hard-coded credentials - [Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.](https://agentprime.io/advisories/CVE-2025-56466.md) `CVE-2025-56466` · CVE record · CVSS 7.5 High · Not analysed yet · Published 10 Sept 2025 · Tags: Hard-coded credentials - [Insufficiently protected credentials in NVIDIA NVDebug tool](https://agentprime.io/advisories/CVE-2025-23342.md) `CVE-2025-23342` · CVE record: NVIDIA NVDebug tool · CVSS 8.2 High · Not analysed yet · Published 9 Sept 2025 · Tags: Hard-coded credentials - [Hard-coded credentials in Baicells SPECTRA LTE-U eNB](https://agentprime.io/advisories/CVE-2025-55047.md) `CVE-2025-55047` · CVE record: Baicells SPECTRA LTE-U eNB · CVSS 8.4 High · Not analysed yet · Published 9 Sept 2025 · Tags: Hard-coded credentials - [Insecure Storage of Sensitive Information in SAP Business One (SLD)](https://agentprime.io/advisories/CVE-2025-42933.md) `CVE-2025-42933` · CVE record: SAP_SE SAP Business One (SLD) · CVSS 8.8 High · Not analysed yet · Published 9 Sept 2025 · Tags: Hard-coded credentials - [Credential Disclosure via Insecure Storage on Charge Controller](https://agentprime.io/advisories/CVE-2025-41682.md) `CVE-2025-41682` · CVE record: Bender CC612 and 3 more · CVSS 8.8 High · Not analysed yet · Published 8 Sept 2025 · Tags: Hard-coded credentials - [running-elephant Datart API AESUtil.java getTokensecret hard-coded key](https://agentprime.io/advisories/CVE-2025-10080.md) `CVE-2025-10080` · CVE record: running-elephant Datart · CVSS 2.3 Low · Not analysed yet · Published 8 Sept 2025 · Tags: Hard-coded credentials, CWE-320 - [Onyxia private helm repository credentials are leaked through unauthenticated API](https://agentprime.io/advisories/CVE-2025-58366.md) `CVE-2025-58366` · CVE record: InseeFrLab onyxia · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Sept 2025 · Tags: Hard-coded credentials Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .