Hard-coded credentials.

Hard-coded credentials in NVIDIA Infrastructure Controller

• NVIDIA Infrastructure Controller
• Hard-coded credentials

Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

• Checkmk
• Hard-coded credentials

Joplin: KaTeX `trust:true` enables URL-allowlist bypass leading to NTLMv2 credential theft via UNC path on Windows

• laurent22 joplin
• Information disclosure
• Hard-coded credentials

HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack

• sysadminsmedia homebox
• Hard-coded credentials
• Broken access control

GoCD is vulnerable to credential exposure when admins insecurely configure material URLs

• gocd
• Information disclosure
• Hard-coded credentials

Hardcoded Key Vulnerability in ZTE SmartLife APP

• ZTE SmartLife
• Hard-coded credentials

aiyiyi121 SxDevOps Settings settings.py hard-coded credentials

• aiyiyi121 SxDevOps
• Hard-coded credentials

aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials

• aiyiyi121 SxDevOps
• Hard-coded credentials

IBM Guardium Data Protection is affected by multiple vulnerabilities.

• IBM Guardium Data Protection
• Hard-coded credentials

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

• Information disclosure
• Hard-coded credentials

<1.6.15 · fixed in 1.6.15

Use of Hard-coded Credentials in Bransys ELD

• Bransys ELD
• Hard-coded credentials

Use of Hard-coded Credentials in Bransys ELD

• Bransys ELD
• Hard-coded credentials

WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

• LabRedesCefetRJ WeGIA
• Authentication bypass
• Hard-coded credentials

Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

• Hard-coded credentials

<2.0.16 · fixed in 2.0.16

Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled

• Hard-coded credentials

<2.0.16 · fixed in 2.0.16

Obsidian Web MCP: Unauthenticated vault access: /oauth/authorize auto-approves without authenticating the user

• jimprosser obsidian-web-mcp
• Authentication bypass
• Hard-coded credentials

lxc-ci: Pacman keyring stored in archlinux image with a private key

• lxc-ci
• Hard-coded credentials

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

• Information disclosure
• Hard-coded credentials

>=3.0.9, <3.0.12 || >=2.14.5, <2.16.1 · fixed in 3.0.12, 2.16.1

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

• Weak cryptography or TLS
• Hard-coded credentials

>=3.0.0, <3.0.12 || >=2.0.0, <2.16.1 · fixed in 3.0.12, 2.16.1

SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

• SolarWinds Access Rights Manager
• Hard-coded credentials

AsyncHttpClient: SOCKS proxy credentials sent to the origin server over plaintext HTTP

• AsyncHttpClient async-http-client
• Weak cryptography or TLS
• Hard-coded credentials

pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools

• pgadmin.org pgAdmin 4
• Command injection
• Hard-coded credentials

Hard-coded credentials in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Hard-coded credentials

Hard-coded cryptographic key in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others

• Dell OpenManage Server Administrator Managed Node (Patch) for Windows
• Dell OpenManage Server Administrator Managed Node for RHEL 8.10
• Hard-coded credentials

Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software

• Acer System Monitoring
• Hard-coded credentials

Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense

• Acer Agent Service
• Hard-coded credentials

All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Insufficient Credential Protection via Authorization Basic Header

• servmask All-in-One WP Migration and Backup
• Hard-coded credentials

Feast through 0.66.0 Authentication Bypass via Unverified Token

• feast
• Hard-coded credentials

SecObserve before 1.59.1 Information Disclosure via API Configuration

• SecObserve
• Hard-coded credentials

Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities

• Cisco Identity Services Engine Software
• Cisco ISE Passive Identity Connector
• Hard-coded credentials

Insufficiently protected credentials in Jenkins Project Jenkins GitLab Plugin

• Jenkins Project Jenkins GitLab Plugin
• Hard-coded credentials

Hard-coded cryptographic key in QualitySoft Corporation QND Premium and others

• QualitySoft Corporation QND Premium
• QualitySoft Corporation QND Standard
• Hard-coded credentials

Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers

• Netcore NR255-V
• Hard-coded credentials

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers

• Netcore NR255-V
• Hard-coded credentials

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi

• Netcore NR255-V
• Hard-coded credentials

Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi

• Netcore NR255-V
• Hard-coded credentials

Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi

• Netcore NR255-V
• Hard-coded credentials

Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

• Wärtsilä FOS-Onboard
• Hard-coded credentials

Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

• Wärtsilä FOS-Onboard
• Hard-coded credentials

Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

• Digital Watchdog VMAX A1 G4 DVR
• Digital Watchdog VMAX IP G4 NVR
• Hard-coded credentials

Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

• Digital Watchdog VMAX A1 G4 DVR
• Digital Watchdog VMAX IP G4 NVR
• Hard-coded credentials

Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth

• Hard-coded credentials

<=2.5.0 · no fixed version yet

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access
• IBM Security Verify Access
• Hard-coded credentials

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

• Issabel Foundation Issabel Framework
• Hard-coded credentials

OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

• OpenBMC phosphor-net-ipmid
• Memory corruption
• Hard-coded credentials

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

• Hard-coded credentials

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.

• Hard-coded credentials

Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

• crawlab
• Hard-coded credentials

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI

• Apache Software Foundation Apache Storm Nimbus
• Apache Software Foundation Apache Storm UI
• Hard-coded credentials
• Broken access control

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

• Apache Software Foundation Apache Storm Nimbus
• Apache Software Foundation Apache Storm Client
• Hard-coded credentials
• Information disclosure

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

• Apache Software Foundation Apache Storm Nimbus
• Apache Software Foundation Apache Storm UI
• Information disclosure
• Hard-coded credentials

Apache Syncope: Nested secrets leak cleartext into audit records readable

• Apache Software Foundation Apache Syncope
• Hard-coded credentials

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

• MISP
• Information disclosure
• Hard-coded credentials

Insufficiently protected credentials in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*

• Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
• Hard-coded credentials

dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

• dromara orion-visor
• Hard-coded credentials
• CWE-320

dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentials

• dromara orion-visor
• Hard-coded credentials

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

• Hard-coded credentials

<0.84.0 · fixed in 0.84.0

Insufficiently protected credentials in Schneider Electric SCADAPack 47x and others

• Schneider Electric SCADAPack 47x
• Schneider Electric SCADAPack 47xi
• Hard-coded credentials

CareCam Pro IP Cameras Use of Hard-coded Credentials

• CareCam ANJIA AJL33PC0801 Firmware
• Hard-coded credentials

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and comp…

• Hard-coded credentials