Hard-coded credentials.

CVE-2025-6077

• Partner Software Partner Web
• Hard-coded credentials

Weak password requirements in Quantum SuperLoader

• Quantum SuperLoader
• Hard-coded credentials

Hard-Coded Encryption Keys found in System

• Hewlett Packard Enterprise HPE Telco Network Function Virtual Orchestrator
• Hard-coded credentials

Hard-Coded Authentication Keys found in System

• Hewlett Packard Enterprise HPE Telco Network Function Virtual Orchestrator
• Hard-coded credentials

Array Networks vAPV and vxAG Default Credential Privilege Escalation

• Array Networks vAPV
• Array Networks vxAG
• Broken access control
• Hard-coded credentials

Weak credentials in ZTE Japan. K.K. ZXHN-F660T and others

• ZTE Japan. K.K. ZXHN-F660T
• ZTE Japan. K.K. ZXHN-F660A
• Hard-coded credentials

Hard-coded password in Dell SmartFabric OS10 Software

• Dell SmartFabric OS10 Software
• Hard-coded credentials

GLPI's MailCollector Receiver is vulnerable to credential exfiltration

• glpi
• Hard-coded credentials

Mattermost has Insufficiently Protected Credentials in github.com/mattermost/mattermost-server

• Hard-coded credentials

>=9.11.0+incompatible, <9.11.17+incompatible || >=10.5.0+incompatible, <10.5.8+incompatible · fixed in 9.11.17+incompatible, 10.5.8+incompatible

Retrievable password hash protecting TSplus admin console

• TSplus Remote Access
• Hard-coded credentials
• CWE-759

Sandboxie exposes encrypted sandbox key during password change

• Sandboxie
• Information disclosure
• Hard-coded credentials

RevelaCode exposes Sensitive MongoDB Atlas URI in .env (potential credential leak)

• musombi123 RevelaCode-Backend
• Hard-coded credentials

An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices.

• Hard-coded credentials

D-Link DIR-890L UART Port rgbin hard-coded credentials

• D-Link DIR-890L
• Hard-coded credentials

Tenda AC18 Samba smb.conf weak password

• Tenda AC18
• Hard-coded credentials

Opencast still publishes global system account credentials

• Information disclosure
• Hard-coded credentials

<17.6 · fixed in 17.6

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read

• Sitecore Experience Manager (XM)
• Sitecore Experience Platform (XP)
• Hard-coded credentials
• Information disclosure

Pandora FMS ≤ 5.0 SP2 Default Credential SQL Injection RCE

• Artica ST Pandora FMS
• SQL injection
• Hard-coded credentials

Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.

• Hard-coded credentials

HCL iAutomate is affected by hardcoded credentials

• HCL Software iAutomate
• Hard-coded credentials

Hard-coded credentials in Samsung Electronics MagicINFO 9 Server

• Samsung Electronics MagicINFO 9 Server
• Hard-coded credentials

Hard-coded credentials in Samsung Electronics MagicINFO 9 Server

• Samsung Electronics MagicINFO 9 Server
• Hard-coded credentials

Poly Clariti Manager - Multiple Security Vulnerabilities

• HP Inc. Poly Clariti Manager
• Hard-coded credentials

Weak credentials in Devolutions Server

• Devolutions Server
• Hard-coded credentials

Hardcoded Credentials in PAVO Inc.'s PAVO Pay

• PAVO Inc. PAVO Pay
• Hard-coded credentials

Hard-coded credentials in MyASUS

• MyASUS
• Hard-coded credentials

Hard-coded credentials in MyASUS

• MyASUS
• Hard-coded credentials

Hardcoded SQLite password in FARA

• SIGNUM-NET FARA
• Hard-coded credentials

Use of hardcoded cryptographic key in Encryption.cs in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords to other servers from hMailAdmin.exe.config file to access other hMailServ…

• Hard-coded credentials

Use of hardcoded cryptographic key in BlowFish.cpp in hMailServer 5.8.6 and 5.6.9-beta allows attacker to decrypt passwords used in database connections from hMailServer.ini config file.

• Hard-coded credentials

Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5

• TP-Link Systems Inc. Archer C50 V3
• TP-Link Systems Inc. Archer C50 V4
• Hard-coded credentials

Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router

• Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)
• Hard-coded credentials

Hard-coded credentials in ZEXELON CO., LTD. ZWX-2000CSW2-HN and others

• ZEXELON CO., LTD. ZWX-2000CSW2-HN
• ZEXELON CO., LTD. ZWX-2000CS2-HN
• Hard-coded credentials

Remote Code Execution in ProTNS ActADUR

• ProTNS ActADUR
• Command injection
• Authentication bypass

An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet…

• Authentication bypass
• Hard-coded credentials

Teledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded password

• Teledyne FLIR FB-Series O
• Teledyne FLIR FH-Series ID
• Hard-coded credentials
• CWE-255

LB-LINK BL-AC3600 shadow hard-coded credentials

• LB-LINK BL-AC3600
• Hard-coded credentials

Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-.

• Hard-coded credentials

Hard-coded credentials in Ivanti DSM

• Ivanti DSM
• Hard-coded credentials

ZPan Uses Hard-Coded Password

• Hard-coded credentials
• CWE-255

<1.6.6 · fixed in 1.6.6

Hard-coded credentials in Shenzhen Liandian Communication Technology LTD V380 IP Camera / AppFHE1_V1.0.6.0

• Shenzhen Liandian Communication Technology LTD V380 IP Camera / AppFHE1_V1.0.6.0
• Hard-coded credentials

Premium Age Verification / Restriction for WordPress <= 3.0.2 - Unauthenticated Arbitrary File Read and Write via remote_tunnel.php

• aa-team Premium Age Verification / Restriction for WordPress
• Hard-coded credentials

Hard-coded credentials in Mitsubishi Electric Corporation PV-DR004J and others

• Mitsubishi Electric Corporation PV-DR004J
• Mitsubishi Electric Corporation PV-DR004JA
• Hard-coded credentials

Weak password requirements in Mitsubishi Electric Corporation PV-DR004J and others

• Mitsubishi Electric Corporation PV-DR004J
• Mitsubishi Electric Corporation PV-DR004JA
• Hard-coded credentials

Jenkins Applitools Eyes Plugin vulnerability does not mask API keys on its job configuration form

• Hard-coded credentials

<=1.16.5 · no fixed version yet

Jenkins VAddy Plugin vulnerability exposes plaintext keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.2.8 · no fixed version yet

Jenkins ReadyAPI Functional Testing Plugin vulnerability exposes secrets

• Hard-coded credentials

<=1.11 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins IBM Cloud DevOps Plugin vulnerability exposes SonarQube authentication tokens

• Weak cryptography or TLS
• Hard-coded credentials

<=2.0.16 · no fixed version yet

Jenkins Dead Man's Snitch Plugin vulnerability does not mask tokens

• Hard-coded credentials

<=0.1 · no fixed version yet

Jenkins IFTTT Build Notifier Plugin vulnerability exposes IFTTT Maker Channel Keys

• Hard-coded credentials
• CWE-256

<=1.2 · no fixed version yet

Jenkins QMetry Test Management Plugin vulnerability exposes API keys

• Hard-coded credentials
• CWE-256

<=1.13 · no fixed version yet

Jenkins Testsigma Test Plan vulnerability exposes API keys via job configuration form

• Hard-coded credentials

<=1.6 · no fixed version yet

Jenkins ReadyAPI Functional Testing Plugin vulnerability stores unencrypted authentication credentials

• Hard-coded credentials
• CWE-256

<=1.11 · no fixed version yet

Jenkins Dead Man's Snitch Plugin vulnerability stores tokens in plain text

• Weak cryptography or TLS
• Hard-coded credentials

<=0.1 · no fixed version yet

Jenkins Nouvola DiveCloud Plugin vulnerability does not mask keys on its job configuration form

• Hard-coded credentials
• CWE-256

<=1.08 · no fixed version yet

Jenkins Apica Loadtest Plugin vulnerability exposes authentication tokens

• Hard-coded credentials
• CWE-256

<=1.10 · no fixed version yet

Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens

• Weak cryptography or TLS
• Hard-coded credentials

<=3.2.8 · no fixed version yet

Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key

• Hard-coded credentials

<=2.0.3 · no fixed version yet

Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages

• Hard-coded credentials
• CWE-779

<687.689.v1a · fixed in 687.689.v1a