Hard-coded credentials.

CodexBar < 0.33.0 Credential Leakage via HTTP Redirect

• steipete CodexBar
• Hard-coded credentials

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

• Information disclosure
• Authentication bypass

<1.0.109 · fixed in 1.0.109

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

• Information disclosure
• Weak cryptography or TLS

<18.1.2 · fixed in 18.1.2

Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

• Hard-coded credentials

<0.0.0-20260517152733-cc82b9740fa6 · fixed in 0.0.0-20260517152733-cc82b9740fa6

Visual Studio Code Elevation of Privilege Vulnerability

• Microsoft Visual Studio Code
• Authentication bypass
• Hard-coded credentials

Reactor Netty HTTP Client Leaks Credentials On Protocol Downgrade Redirect

• Hard-coded credentials

>=1.3.0, <1.3.6 || >=1.2.0, <1.2.18 || >=1.1.0, <=1.1.31 || >=1.0.0, <=1.0.48 · fixed in 1.3.6, 1.2.18

SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password

• SourceCodester Onlne Examination & Learning Management System
• SourceCodester Syllabus-aligned Learning Management and Examination System
• Hard-coded credentials
• CWE-255

OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Source

• openbullet2
• Hard-coded credentials

SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded password

• SourceCodester Barangay Resident Profiling and Information Management System
• Hard-coded credentials
• CWE-255

GL.iNet XE3000 glnassys hard-coded key

• GL.iNet A1300
• GL.iNet AX1800
• Hard-coded credentials
• CWE-320

Tenda AC15 Samba smb.conf weak password

• Tenda AC15
• Hard-coded credentials

Unauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal

• Altium Enterprise Server
• Path traversal
• Hard-coded credentials

NetMan 204 Hard-coded Backdoor Credentials

• Riello UPS NetMan 204
• Hard-coded credentials

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

• Information disclosure
• Hard-coded credentials

>=1.3.0, <1.6.6 || >=1.7.0, <1.7.3 · fixed in 1.6.6, 1.7.3

Hardcoded Cryptographic Keys and Weak IV Generation in linqi

• linqi
• Hard-coded credentials
• Weak cryptography or TLS

NAVTOR NavBox Use of Hard-coded Credentials

• NAVTOR NavBox
• Hard-coded credentials

Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models

• GX INDIA GX Earth 2022
• GX INDIA GX Earth 1010
• Hard-coded credentials

Firmware Theft & IMEI Spoofing via Connect-OTA

• Acer Connect M6E 5G Portable WiFi Router
• Hard-coded credentials

Bulk User Private Data Harvesting

• Acer Connect M6E 5G Portable WiFi Router
• Hard-coded credentials

Hard-coded AWS Cognito Testing Accounts

• Acer Connect M6E 5G Portable WiFi Router
• Hard-coded credentials

T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access under the "superadmin" account.

• Hard-coded credentials

Hard-coded password in NETAPP Active IQ OneCollect

• NETAPP Active IQ OneCollect
• Hard-coded credentials

Hard-coded password in NETAPP Active IQ Config Advisor

• NETAPP Active IQ Config Advisor
• Hard-coded credentials

Weak password policy in ProjectsAndPrograms school-management-system

• ProjectsAndPrograms school-management-system
• Hard-coded credentials

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware…

• Hard-coded credentials
• CWE-1188

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode.

• Hard-coded credentials

Dräger SC Monitoring Devices Hard-coded Credentials and DoS

• Dräger SC 6002XL
• Dräger SC6802XL
• Hard-coded credentials

Hard-coded credentials in KS-SOMED

• KAMSOFT KS-SOMED
• Hard-coded credentials

Credential Exposure Vulnerability in Trac PDBM

• Trac d.o.o. PDBM
• Hard-coded credentials

Apache Solr has hardcoded credentials in the Basic Authentication setup tool

• Hard-coded credentials
• CWE-1188

>=9.4.0, <=9.10.1 · no fixed version yet

AgenticMail API/storage and outbound relay hardening fixes

• SQL injection
• Broken access control

<0.9.32 · fixed in 0.9.32

Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file

• StrongDM Desktop Application
• StrongDM Desktop Client
• Information disclosure
• Hard-coded credentials

Insufficiently protected credentials in JetBrains TeamCity

• JetBrains TeamCity
• Hard-coded credentials

MacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials

• Danelec MacGregor Voyage Data Recorder (VDR) G4e
• Hard-coded credentials

MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials

• Danelec MacGregor Voyage Data Recorder (VDR) G4e
• Hard-coded credentials

Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials

• Jinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter
• Hard-coded credentials

Dokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret

• dokploy
• Hard-coded credentials

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

• FreePBX security-reporting
• Hard-coded credentials

Indian Scout Bobber 2025 WCM-to-ECM weak authentication

• Indian Motorcycle Scout Bobber + Tech
• Weak cryptography or TLS
• Hard-coded credentials

Acer Wave 7 router: Hardcoded Cryptographic Key

• Acer Wave 7 router
• Hard-coded credentials

RustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation

• rustfs
• Hard-coded credentials
• CWE-1392

RustFS: Hard-coded RSA private key in license verifier permits arbitrary license forgery

• rustfs
• Hard-coded credentials

SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php

• SDMC Technology Co., Ltd NE6037
• Hard-coded credentials

Use of Weak Credentials in D-Link DWR-X1820 router

• D-Link Corporation DWR-X1820
• Hard-coded credentials

IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism

• IBM Operations Analytics - Log Analysis
• Hard-coded credentials

IBM Controller is affected by vulnerabilities

• IBM Controller
• Hard-coded credentials

Use of Weak Credentials in Slican telephone exchanges

• Slican IPx
• Slican CCT-1668
• Hard-coded credentials

Insufficiently protected credentials in Synology Surveillance Station

• Synology Surveillance Station
• Hard-coded credentials

Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials

• Hitachi Vantara Pentaho Data Integration and Analytics
• Hard-coded credentials

@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

• Information disclosure
• Hard-coded credentials

<18.1.1 · fixed in 18.1.1

Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample.

• Hard-coded credentials

Eppendorf BioFlo 320 Use of hard-coded password

• Eppendorf BioFlo 320
• Hard-coded credentials

Besen BS20 EV Charging Station BLE/UDP insufficiently protected credentials

• Besen BS20 EV Charging Station
• Hard-coded credentials

Besen BS20 EV Charging Station Bluetooth Low Energy weak password

• Besen BS20 EV Charging Station
• Hard-coded credentials

TypeBot: Cross-Workspace Credential Theft via Bot-Engine Preview Endpoint

• baptisteArno typebot.io
• Broken access control
• Hard-coded credentials

Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php

• Open ISES Tickets
• Hard-coded credentials

Open ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php

• Open ISES Tickets
• Hard-coded credentials

Open ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php

• Open ISES Tickets
• Hard-coded credentials

Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php

• Open ISES Tickets
• Hard-coded credentials

Open ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php

• Open ISES Tickets
• Hard-coded credentials