Hard-coded credentials.

An issue in Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0 allows a physically proximate attacker to escalate privileges via the RSA private key component

• Hard-coded credentials

LB-LINK X-PRO easycwmp hard-coded credentials

• LB-LINK X-PRO
• Hard-coded credentials

LB-LINK X-PRO shadow hard-coded credentials

• LB-LINK X-PRO
• Hard-coded credentials

Airwall - Hardcoded Secrets

• Johnson Controls Airwall
• Hard-coded credentials

Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover

• emlog
• Cross-site request forgery (CSRF)
• Hard-coded credentials

Hard-coded credentials in Dell Wyse Management Suite (WMS)

• Dell Wyse Management Suite (WMS)
• Hard-coded credentials

Use of hard-coded credentials in Prospero Flow CRM employee onboarding

• Roskus Prospero Flow CRM
• Hard-coded credentials

Budibase before 3.40.0 Credential Exposure via STRING Fields

• budibase
• Hard-coded credentials

Tenda CH/CP/TX3 SSH hard-coded password

• Tenda CH
• Tenda CP
• Hard-coded credentials
• CWE-255

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

• IBM Documentation Offline
• Hard-coded credentials

The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

• IBM Storage Scale
• Hard-coded credentials

Flow Neuroscience FL-100 Use of Hard-coded Credentials

• Flow Neuroscience FL-100
• Halo Neuroscience FL-100
• Hard-coded credentials

CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal

• usmannasir cyberpanel
• Hard-coded credentials

Hard-coded cryptographic key in Lenovo Accessories and Display Manager

• Lenovo Accessories and Display Manager
• Hard-coded credentials

SMP security request

• silabs.com WiseConnect
• Hard-coded credentials

Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

• Portal Generator addon to Priority ERP (developed by Soft Solutions)
• Hard-coded credentials

Prisma Browser: Sensitive Information Disclosure Vulnerability

• Palo Alto Networks Prisma Browser
• Hard-coded credentials

Prisma Browser: Inappropriate Implementation in Account Protection

• Palo Alto Networks Prisma Browser
• Hard-coded credentials

Duplicate Advisory: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

• Hard-coded credentials

<=3.7.2 · no fixed version yet

Duplicate Advisory: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

• Hard-coded credentials

<=3.7.2 · no fixed version yet

Duplicate Advisory: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

• Hard-coded credentials

<=3.7.3 · no fixed version yet

WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

• wolfsoftwaresystemsltd WolfStack
• Hard-coded credentials

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

• IBM i Access Client Solutions
• Hard-coded credentials

Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Firmware
• Quanovate Tech Inc. (operating as Mira / Mira Care) Mira Android App
• Hard-coded credentials

MaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust

• dromara MaxKey
• Hard-coded credentials

Microsoft SharePoint Server Spoofing Vulnerability

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Hard-coded credentials

Microsoft Outlook Spoofing Vulnerability

• Microsoft 365 Apps for Enterprise
• Microsoft Office 2019
• Hard-coded credentials

ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)

• Adobe ColdFusion 2025
• Adobe ColdFusion 2023
• Hard-coded credentials

Hard-coded cryptographic key in Siemens LOGO! Soft Comfort

• Siemens LOGO! Soft Comfort
• Hard-coded credentials

Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)

• SAP_SE SAP BusinessObjects Business Intelligence Platform (Central Management Server)
• Hard-coded credentials

Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)

• SAP_SE SAP Advanced Planning and Optimization (Model Mix Planning)
• Hard-coded credentials

Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices

• TP-Link Systems Inc. HB810(US2) V1.0/1.6/2.0/2.6
• TP-Link Systems Inc. HB810(EU1) V2.0
• Hard-coded credentials

Backdoor / default root credentials

• TBEA TLogger (TBEA Communication Box 3rd Generation)
• Hard-coded credentials

Multicluster-global-hub: multicluster-global-hub: spec-topic read acl leaks bootstrap kubeconfigs to all managed hubs during migration

• Red Hat Multicluster Global Hub 1.4.9
• Red Hat Multicluster Global Hub 1.5.8
• Hard-coded credentials

Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601

• Zyxel Networks WAH7601
• Hard-coded credentials

Hardcoded Credentials in Zyxel WAH7601 Router

• Zyxel Networks WAH7601
• Hard-coded credentials

Weak credentials in ECOVACS ROBOTICS DEEBOT PRO M1 and others

• ECOVACS ROBOTICS DEEBOT PRO M1
• ECOVACS ROBOTICS DEEBOT PRO K1VAC
• Hard-coded credentials

Weak credentials in ECOVACS ROBOTICS DEEBOT PRO M1 and others

• ECOVACS ROBOTICS DEEBOT PRO M1
• ECOVACS ROBOTICS DEEBOT PRO K1VAC
• Hard-coded credentials

Pathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLs

• aehrc pathling
• Hard-coded credentials
• Server-side request forgery (SSRF)

Pathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltration

• aehrc pathling
• Hard-coded credentials
• Server-side request forgery (SSRF)

TeamDavid: Weak Cryptography and Insecure Password Storage

• Tobit Laboratories AG TeamDavid
• Hard-coded credentials

Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product

• ZTE F689
• Hard-coded credentials

Information leakage vulnerability in ZTE F689 product

• ZTE F689
• Hard-coded credentials

TLS credential leakage vulnerability in ZTE F689 product

• ZTE F689
• Hard-coded credentials

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

• Weak cryptography or TLS
• Hard-coded credentials

<1.74.4 · fixed in 1.74.4

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

• Weak cryptography or TLS
• Hard-coded credentials

<1.75.0 · fixed in 1.75.0

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

• Information disclosure
• Weak cryptography or TLS

<1.75.0 · fixed in 1.75.0

Use of hard-coded cryptographic key in Acrisure KARR BT and DR-100

• Acrisure KARR BT
• Acrisure DR-100
• Hard-coded credentials

HCL Digital Experience and Digital Experience Compose insufficiently protects credentials

• HCLSoftware HCL Digital Experience and Digital Experience Compose
• Hard-coded credentials
• Information disclosure

Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

• Information disclosure
• Hard-coded credentials

>=6.0.0-alpha.1, <=6.30.0 · no fixed version yet

ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

• esphome
• Hard-coded credentials

DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

• DjangoCRM django-crm
• Hard-coded credentials

My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user account…

• Hard-coded credentials

Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources

• Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources
• Hard-coded credentials

Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

• GeoVision Inc. GV-AS1620 (GV-Cloud)
• Hard-coded credentials

Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)

• GeoVision Inc. GV-AS1620 (AS-Manager)
• Hard-coded credentials

Hardcoded Certificates in TP-Link Omada Device Communications

• TP-Link Systems Inc. Omada Gateways
• TP-Link Systems Inc. Omada Switches
• Hard-coded credentials

Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

• TP-Link Systems Inc. Omada Gateways
• TP-Link Systems Inc. Omada Switches
• Hard-coded credentials

Wings exposes node configuration secrets through egg configuration-file templating

• Information disclosure
• Hard-coded credentials

<1.12.3 · fixed in 1.12.3

pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

• pgadmin.org pgAdmin 4
• Hard-coded credentials
• Broken access control