# Hard-coded credentials.

Passwords and keys built into the code, or weak credentials. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2.](https://agentprime.io/advisories/CVE-2025-54341.md)
  `CVE-2025-54341` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 24 Nov 2025 · Tags: Hard-coded credentials
- [Hard-coded encryption keys in Twonky Server](https://agentprime.io/advisories/CVE-2025-13316.md)
  `CVE-2025-13316` · CVE record: Lynxtechnology Twonky Server · CVSS 8.2 High · Not analysed yet · Published 19 Nov 2025 · Tags: Hard-coded credentials
- [LibreNMS has Weak Password Policy](https://agentprime.io/advisories/GHSA-5mrf-j8v6-f45g.md)
  `GHSA-5mrf-j8v6-f45g`, `CVE-2025-65014`, `PKSA-5jjt-bqv9-rkt7` · Packagist `librenms/librenms`: affected `<25.11.0`, fixed in `25.11.0` · CVSS 3.7 Low · Not analysed yet · Published 18 Nov 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Fortinet FortiWeb](https://agentprime.io/advisories/CVE-2025-59669.md)
  `CVE-2025-59669` · CVE record: Fortinet FortiWeb · CVSS 4.8 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Hard-coded credentials
- [The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation.](https://agentprime.io/advisories/CVE-2025-63800.md)
  `CVE-2025-63800` · CVE record · CVSS 7.5 High · Not analysed yet · Published 18 Nov 2025 · Tags: Hard-coded credentials
- [NixOS has hardcoded credentials in Onlyoffice module](https://agentprime.io/advisories/CVE-2025-64766.md)
  `CVE-2025-64766` · CVE record: NixOS nixpkgs · CVSS 5.3 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Hard-coded credentials
- [Digiwin｜EasyFlow GP - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2025-13164.md)
  `CVE-2025-13164` · CVE record: Digiwin EasyFlow GP · CVSS 6.9 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Hard-coded credentials
- [Digiwin｜EasyFlow GP - Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2025-13163.md)
  `CVE-2025-13163` · CVE record: Digiwin EasyFlow GP · CVSS 6.9 Medium · Not analysed yet · Published 17 Nov 2025 · Tags: Hard-coded credentials
- [QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page.](https://agentprime.io/advisories/CVE-2025-63747.md)
  `CVE-2025-63747` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Nov 2025 · Tags: Hard-coded credentials
- [shsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentials](https://agentprime.io/advisories/CVE-2025-13252.md)
  `CVE-2025-13252` · CVE record: shsuishang ShopSuite ModulithShop · CVSS 6.9 Medium · Not analysed yet · Published 16 Nov 2025 · Tags: Hard-coded credentials
- [General Industrial Controls Lynx+ Gateway Weak Password Requirements](https://agentprime.io/advisories/CVE-2025-55034.md)
  `CVE-2025-55034` · CVE record: General Industrial Controls Lynx+ Gateway · CVSS 8.8 High · Not analysed yet · Published 14 Nov 2025 · Tags: Hard-coded credentials
- [AstrBot is vulnerable to RCE with hard-coded JWT signing keys](https://agentprime.io/advisories/GHSA-4m32-cjv7-f425.md)
  `GHSA-4m32-cjv7-f425`, `CVE-2025-55449`, `PYSEC-2026-285` · PyPI `astrbot`: affected `<3.5.18`, fixed in `3.5.18` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2025 · Tags: Hard-coded credentials, CWE-345
- [AIX Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2025-36096.md)
  `CVE-2025-36096` · CVE record: IBM AIX and 1 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Nov 2025 · Tags: Hard-coded credentials
- [Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryption_helper.dart file](https://agentprime.io/advisories/CVE-2025-63289.md)
  `CVE-2025-63289` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Nov 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in AuthN component of NVIDIA AIStore](https://agentprime.io/advisories/CVE-2025-33186.md)
  `CVE-2025-33186` · CVE record: NVIDIA AuthN component of NVIDIA AIStore · CVSS 8.8 High · Not analysed yet · Published 11 Nov 2025 · Tags: Hard-coded credentials
- [Insufficiently protected credentials in Axis Communications AB AXIS OS](https://agentprime.io/advisories/CVE-2025-6571.md)
  `CVE-2025-6571` · CVE record: Axis Communications AB AXIS OS · CVSS 6.0 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Hard-coded credentials
- [Information Disclosure vulnerability in SAP Business One (SLD)](https://agentprime.io/advisories/CVE-2025-42897.md)
  `CVE-2025-42897` · CVE record: SAP_SE SAP Business One (SLD) · CVSS 5.3 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: Hard-coded credentials
- [Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)](https://agentprime.io/advisories/CVE-2025-42890.md)
  `CVE-2025-42890` · CVE record: SAP_SE SQL Anywhere Monitor (Non-Gui) · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Nov 2025 · Tags: Hard-coded credentials
- [Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key](https://agentprime.io/advisories/CVE-2025-12177.md)
  `CVE-2025-12177` · CVE record: codename065 Download Manager · CVSS 5.3 Medium · Not analysed yet · Published 8 Nov 2025 · Tags: Hard-coded credentials
- [Ubia Ubox](https://agentprime.io/advisories/CVE-2025-12636.md)
  `CVE-2025-12636` · CVE record: Ubia Ubox Android and 1 more · CVSS 7.1 High · Not analysed yet · Published 6 Nov 2025 · Tags: Hard-coded credentials
- [KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass](https://agentprime.io/advisories/CVE-2025-12676.md)
  `CVE-2025-12676` · CVE record: mykiot KiotViet Sync · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2025 · Tags: Hard-coded credentials
- [Insufficiently Protected Credentials in Radiometrics VizAir](https://agentprime.io/advisories/CVE-2025-54863.md)
  `CVE-2025-54863` · CVE record: Radiometrics VizAir · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Nov 2025 · Tags: Hard-coded credentials
- [Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services](https://agentprime.io/advisories/CVE-2025-34501.md)
  `CVE-2025-34501` · CVE record: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2 · CVSS 7.0 High · Not analysed yet · Published 3 Nov 2025 · Tags: Hard-coded credentials
- [PHPGurukul News Portal settings.py hard-coded key](https://agentprime.io/advisories/CVE-2025-12615.md)
  `CVE-2025-12615` · CVE record: PHPGurukul News Portal · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2025 · Tags: Hard-coded credentials, CWE-320
- [Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000)](https://agentprime.io/advisories/CVE-2025-12599.md)
  `CVE-2025-12599` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2025 · Tags: Hard-coded credentials
- [Insufficient Password Policy](https://agentprime.io/advisories/CVE-2025-12552.md)
  `CVE-2025-12552` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 31 Oct 2025 · Tags: Hard-coded credentials
- [Nagios Log Server < 2024R2.0.2 AD/LDAP Import Password Not Obfuscated](https://agentprime.io/advisories/CVE-2025-34270.md)
  `CVE-2025-34270` · CVE record: Nagios Log Server · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2025 · Tags: Information disclosure, Hard-coded credentials
- [MLflow Weak Password Requirements Authentication Bypass Vulnerability](https://agentprime.io/advisories/GHSA-6xj8-rrqx-r4cv.md)
  `GHSA-6xj8-rrqx-r4cv`, `BIT-mlflow-2025-11200`, `CVE-2025-11200`, `PYSEC-2026-1642` · PyPI `mlflow`: affected `<2.22.0rc0`, fixed in `2.22.0rc0` · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2025 · Tags: Hard-coded credentials
- [Unprotected access to parts of the application in Epsilon RH by Grupo Castilla](https://agentprime.io/advisories/CVE-2025-12461.md)
  `CVE-2025-12461` · CVE record: Grupo Castilla Epsilon RH · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2025 · Tags: Hard-coded credentials
- [GitHub Workflow Updater stored the optional Github token in plaintext](https://agentprime.io/advisories/CVE-2025-62794.md)
  `CVE-2025-62794` · CVE record: RichardoC github-workflow-updater-extension · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in PLANEX COMMUNICATIONS INC. MZK-DP300N](https://agentprime.io/advisories/CVE-2025-62777.md)
  `CVE-2025-62777` · CVE record: PLANEX COMMUNICATIONS INC. MZK-DP300N · CVSS 8.7 High · Not analysed yet · Published 28 Oct 2025 · Tags: Hard-coded credentials
- [Weak Password Policy](https://agentprime.io/advisories/CVE-2025-12364.md)
  `CVE-2025-12364` · CVE record: Azure Access Technology BLU-IC2 and 1 more · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2025 · Tags: Hard-coded credentials
- [Unsecure access configuration](https://agentprime.io/advisories/CVE-2025-59460.md)
  `CVE-2025-59460` · CVE record: SICK AG TLOC100-100 with Firmware <7.1.1 and 1 more · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: Hard-coded credentials
- [Private Key Disclosure Vulnerability in ZTE ZXMP M721 Product](https://agentprime.io/advisories/CVE-2025-46582.md)
  `CVE-2025-46582` · CVE record: ZTE ZXMP M721 · CVSS 7.7 High · Not analysed yet · Published 27 Oct 2025 · Tags: Hard-coded credentials
- [Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two factor authentication.](https://agentprime.io/advisories/CVE-2025-61482.md)
  `CVE-2025-61482` · CVE record · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2025 · Tags: Information disclosure, Hard-coded credentials
- [Shuffle Master Deck Mate 2 Insecure Update Chain](https://agentprime.io/advisories/CVE-2025-34500.md)
  `CVE-2025-34500` · CVE record: Light & Wonder, Inc. / SHFL Entertainment, Inc. / Shuffle Master, Inc. Deck Mate 2 · CVSS 7.0 High · Not analysed yet · Published 24 Oct 2025 · Tags: Hard-coded credentials, Weak cryptography or TLS
- [Microweber CMS 2.0 has Weak Password Requirements.](https://agentprime.io/advisories/CVE-2025-60954.md)
  `CVE-2025-60954` · CVE record · CVSS 8.3 High · Not analysed yet · Published 24 Oct 2025 · Tags: Hard-coded credentials
- [Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials](https://agentprime.io/advisories/CVE-2025-54808.md)
  `CVE-2025-54808` · CVE record: Oxford Nanopore Technologies MinKNOW · CVSS 7.3 High · Not analysed yet · Published 23 Oct 2025 · Tags: Hard-coded credentials
- [Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar](https://agentprime.io/advisories/GHSA-33f4-mjch-7fpr.md)
  `GHSA-33f4-mjch-7fpr`, `CVE-2025-61926`, `GO-2025-4018` · Go `github.com/ossf/allstar`: affected `<0.0.0-20250721181116-e004ecb540d6`, fixed in `0.0.0-20250721181116-e004ecb540d6` · CVSS 4.6 Medium · Not analysed yet · Published 23 Oct 2025 · Tags: Hard-coded credentials, CWE-453
- [Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60](https://agentprime.io/advisories/CVE-2025-41109.md)
  `CVE-2025-41109` · CVE record: Ghost Robotics Vision 60 · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2025 · Tags: Hard-coded credentials
- [Sauter: Hard-coded Authentication Credentials](https://agentprime.io/advisories/CVE-2025-41722.md)
  `CVE-2025-41722` · CVE record: Sauter modulo 6 devices modu680-AS and 4 more · CVSS 7.5 High · Not analysed yet · Published 22 Oct 2025 · Tags: Hard-coded credentials
- [NeuVector is shipping cryptographic material into its binary](https://agentprime.io/advisories/GHSA-h773-7gf7-9m2x.md)
  `GHSA-h773-7gf7-9m2x`, `CVE-2025-54471`, `GO-2025-4043` · Go `github.com/neuvector/neuvector`: affected `>=0.0.0-20230727023453-1c4957d53911, <0.0.0-20251020133207-084a437033b4 || >=5.3.0, <5.4.7`, fixed in `0.0.0-20251020133207-084a437033b4`, `5.4.7` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Hard-coded credentials
- [Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional](https://agentprime.io/advisories/CVE-2025-10639.md)
  `CVE-2025-10639` · CVE record: EfficientLab WorkExaminer Professional · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2025 · Tags: Hard-coded credentials
- [The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data sto…](https://agentprime.io/advisories/CVE-2025-56802.md)
  `CVE-2025-56802` · CVE record · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Hard-coded credentials
- [The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access to the application env…](https://agentprime.io/advisories/CVE-2025-56801.md)
  `CVE-2025-56801` · CVE record · CVSS 5.1 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Hard-coded credentials
- [Flowring Technology｜Agentflow - Use of Hard-coded Cryptographic Key](https://agentprime.io/advisories/CVE-2025-11899.md)
  `CVE-2025-11899` · CVE record: Flowring Technology Agentflow · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2025 · Tags: Hard-coded credentials
- [Hard-coded credentials in Moxa EDR-G9010 Series and others](https://agentprime.io/advisories/CVE-2025-6950.md)
  `CVE-2025-6950` · CVE record: Moxa EDR-G9010 Series and 4 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2025 · Tags: Hard-coded credentials
- [HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage](https://agentprime.io/advisories/CVE-2024-42192.md)
  `CVE-2024-42192` · CVE record: HCL Software Traveler for Microsoft Outlook · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Hard-coded credentials
- [Hard-coded cryptographic key in NEOJAPAN Inc. desknet's NEO](https://agentprime.io/advisories/CVE-2025-58426.md)
  `CVE-2025-58426` · CVE record: NEOJAPAN Inc. desknet's NEO · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Hard-coded credentials
- [Felan Framework <= 1.1.4 - Hardcoded Credentials](https://agentprime.io/advisories/CVE-2025-10850.md)
  `CVE-2025-10850` · CVE record: RiceTheme Felan Framework · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2025 · Tags: Hard-coded credentials
- [A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C.](https://agentprime.io/advisories/CVE-2025-61330.md)
  `CVE-2025-61330` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Hard-coded credentials
- [Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).](https://agentprime.io/advisories/CVE-2025-60639.md)
  `CVE-2025-60639` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2025 · Tags: Hard-coded credentials
- [Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing.](https://agentprime.io/advisories/CVE-2025-56749.md)
  `CVE-2025-56749` · CVE record · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2025 · Tags: Hard-coded credentials
- [Argo Workflow may expose artifact repository credentials](https://agentprime.io/advisories/GHSA-c2hv-4pfj-mm2r.md)
  `GHSA-c2hv-4pfj-mm2r`, `BIT-argo-workflows-2025-62157`, `CVE-2025-62157`, `GO-2025-4024` · Go `github.com/argoproj/argo-workflows/v3`: affected `<3.6.12 || >=3.7.0, <3.7.3`, fixed in `3.6.12`, `3.7.3` · CVSS 8.5 High · Not analysed yet · Published 14 Oct 2025 · Tags: Hard-coded credentials
- [Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded password](https://agentprime.io/advisories/CVE-2025-11666.md)
  `CVE-2025-11666` · CVE record: Tenda RP3 Pro · CVSS 8.4 High · Not analysed yet · Published 13 Oct 2025 · Tags: Hard-coded credentials, CWE-255
- [IBM Security Verify Access hard coded credentials](https://agentprime.io/advisories/CVE-2025-36087.md)
  `CVE-2025-36087` · CVE record: IBM Security Verify Access and 1 more · CVSS 8.1 High · Not analysed yet · Published 13 Oct 2025 · Tags: Hard-coded credentials
- [Tomofun Furbo 360/Furbo Mini Root Account hard-coded password](https://agentprime.io/advisories/CVE-2025-11649.md)
  `CVE-2025-11649` · CVE record: Tomofun Furbo 360 and 1 more · CVSS 7.3 High · Not analysed yet · Published 12 Oct 2025 · Tags: Hard-coded credentials, CWE-255
- [Tomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentials](https://agentprime.io/advisories/CVE-2025-11643.md)
  `CVE-2025-11643` · CVE record: Tomofun Furbo 360 and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2025 · Tags: Hard-coded credentials
- [code-projects Hospital Management System express-session hard-coded key](https://agentprime.io/advisories/CVE-2025-11609.md)
  `CVE-2025-11609` · CVE record: code-projects Hospital Management System · CVSS 6.3 Medium · Not analysed yet · Published 11 Oct 2025 · Tags: Hard-coded credentials, CWE-320
- [Newforma Info Exchange (NIX) insufficiently protected credentials](https://agentprime.io/advisories/CVE-2025-35054.md)
  `CVE-2025-35054` · CVE record: Newforma Project Center · CVSS 4.8 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Hard-coded credentials, Information disclosure, CWE-257

Newest: <https://agentprime.io/advisories/tag/hard-coded-credentials.md>
Older: <https://agentprime.io/advisories/tag/hard-coded-credentials.md?cursor=WyIyMDI1LTEwLTA5VDIwOjIwOjQwLjAyNTAwMFoiLCJDVkUtMjAyNS0zNTA1NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=hard-coded-credentials&cursor=WyIyMDI1LTExLTI0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02MzQzMyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/hard-coded-credentials/?cursor=WyIyMDI1LTExLTI0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNS02MzQzMyJd>. Everything for agents: <https://agentprime.io/llms.txt>.