Hard-coded credentials.

Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

• langgenius dify
• Information disclosure
• Hard-coded credentials

Coolify members can see private key of root user

• coollabsio coolify
• Hard-coded credentials

Nuvation Energy Multi-Stack Controller Private Key Stored on Device

• Nuvation Energy Multi-Stack Controller (MSC)
• Hard-coded credentials

Cypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote Root

• Cypress ONE
• Hard-coded credentials

ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint

• Zblchina ZBL EPON ONU Broadband Router
• Hard-coded credentials

NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup

• NuCom 11N Wireless Router
• Hard-coded credentials

Tenda i24 Shadow File hard-coded credentials

• Tenda i24
• Tenda 4G03 Pro
• Hard-coded credentials

RustFS has a gRPC Hardcoded Token Authentication Bypass

• Authentication bypass
• Hard-coded credentials

>=1.0.0-alpha.13, <1.0.0-alpha.78 · fixed in 1.0.0-alpha.78

Ksenia Security lares Home Automation 1.6 Default Credentials Vulnerability

• Ksenia Security S.p.A. lares
• Hard-coded credentials

Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass

• Ateme Anevia Flamingo XL/XS
• Ateme SoapLive
• Hard-coded credentials

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication Bypass

• SOUND4 Ltd. Impact/Pulse/First
• SOUND4 Ltd. Impact/Pulse Eco
• Hard-coded credentials

PandaXGO PandaX JWT Secret config.yml hard-coded key

• PandaX
• Hard-coded credentials
• CWE-320

getmaxun auth.ts hard-coded key

• maxun
• Hard-coded credentials
• CWE-320

SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret

• siyuan
• Hard-coded credentials

Hardcoding sensitive information

• Hanwha Vision Co., Ltd. Device Manager
• Hard-coded credentials

FaceSentry Access Control System 6.4.8 Remote SSH Root Access

• iWT Ltd. FaceSentry Access Control System
• Hard-coded credentials

FLIR AX8 Thermal Camera 1.32.16 Hard-Coded Credentials Authentication Bypass

• FLIR Systems FLIR AX8 Thermal Camera
• Hard-coded credentials

Hard-coded credentials in NVIDIA Isaac Launchable

• NVIDIA Isaac Launchable
• Hard-coded credentials

Ragic｜Enterprise Cloud Database - Hard-coded Cryptographic Key

• Ragic Enterprise Cloud Database
• Hard-coded credentials

CouchCMS reCAPTCHA config.example.php hard-coded key

• CouchCMS
• Hard-coded credentials
• CWE-320

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded default administrative credentials.

• Hard-coded credentials

Use of Hard-coded Credentials in Utarit Informatics' SoliClub

• Utarit Informatics Services Inc. SoliClub
• Hard-coded credentials

Hardcoded Credentials in Utarit Informatics' SoliClub

• Utarit Information Services Inc. SoliClub
• Hard-coded credentials

Default credentials in Dify thru 1.5.1.

• Hard-coded credentials

Open OnDemand affected by Apache proxy passing sensitive headers

• OSC ondemand
• Hard-coded credentials
• CWE-523

Credential Disclosure vulnerability in Radiometer Products

• Radiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS Analyzers
• Radiometer Medical Aps AQT90 FLEX Analyzers
• Privilege escalation
• Hard-coded credentials

The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate u…

• Weak cryptography or TLS
• Hard-coded credentials

IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability

• UCD - IBM DevOps Deploy
• Hard-coded credentials

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1.

• Hard-coded credentials

MartialBE one-hub docker-compose.yml hard-coded key

• MartialBE one-hub
• Hard-coded credentials
• CWE-320

Hardcoded FTP Credentials within the firmware

• Growatt ShineLan-X
• Hard-coded credentials

Undocumented backup Account and No Password Configuration Capability

• Growatt ShineLan-X
• Hard-coded credentials

Gladinet CentreStack and TrioFox Hard Coded AES Keys

• Gladinet CentreStack and TrioFox
• Hard-coded credentials

Apache StreamPark has a hard-coded encryption key

• Hard-coded credentials

>=2.0.0, <2.1.7 · fixed in 2.1.7

Apache Fineract: Server Key not masked

• Apache Software Foundation Apache Fineract
• Hard-coded credentials

Apache Fineract: weak password policy

• Apache Software Foundation Apache Fineract
• Hard-coded credentials

FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API

• FreePBX endpoint
• Hard-coded credentials

QiHang Media Web Digital Signage 3.0.9 Cleartext Credentials Disclosure

• Shenzhen Xingmeng Qihang Media Co., Ltd.Guangzhou Hefeng Automation Technology Co., Ltd. QiHang Media Web Digital Signage
• Hard-coded credentials

Hard-coded cryptographic keys in EZCast Pro II Dongle

• EZCast Pro II
• Hard-coded credentials

The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on.

• Hard-coded credentials

ColdFusion | Insufficiently Protected Credentials (CWE-522)

• Adobe ColdFusion
• Hard-coded credentials

Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments

• Hard-coded credentials
• CWE-320

<1.9.0-beta.18 || >=1.9.0, <1.9.23 || >=2.0.0-alpha.1, <2.0.0-alpha.52 · fixed in 1.9.0-beta.18, 1.9.23, 2.0.0-alpha.52

Hard-coded credentials in Siemens SIMATIC CN 4100

• Siemens SIMATIC CN 4100
• Hard-coded credentials

Hardcoded User Password

• Phoenix Contact FL SWITCH 2005
• Phoenix Contact FL SWITCH 2008
• Hard-coded credentials

TOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentials

• TOZED ZLT M30S
• TOZED ZLT M30S PRO
• Hard-coded credentials

Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass

• Advantech Co., Ltd. WISE-DeviceOn Server
• Hard-coded credentials

Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.

• Hard-coded credentials

Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials

• Sunbird DCIM dcTrack
• Sunbird Power IQ
• Hard-coded credentials

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the Administrator password in plaintext.

• Hard-coded credentials

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices.

• Hard-coded credentials

ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

• Hard-coded credentials

opsre go-ldap-admin JWT docker-compose.yaml hard-coded key

• opsre go-ldap-admin
• Hard-coded credentials
• CWE-320

Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded Credentials

• Mirion Medical EC2 Software NMIS BioDose
• Hard-coded credentials

arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints

• Broken access control
• Hard-coded credentials

<1.9.1 · fixed in 1.9.1

Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50

• SGE-PLC1000 SGE-PLC50 Circutor
• Hard-coded credentials

motogadget mo.lock Ignition Lock NFC hard-coded key

• motogadget mo.lock Ignition Lock
• Hard-coded credentials
• CWE-320

Hard-coded cryptographic key in Fuji Television Network, Inc. "FOD" App for Android and others

• Fuji Television Network, Inc. "FOD" App for Android
• Fuji Television Network, Inc. "FOD" App for iOS
• Hard-coded credentials

TVT NVMS-9000 Hard-coded API Credentials & Command Injection

• Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000
• Command injection
• Hard-coded credentials

Apache Syncope's AES encryption stores hard-coded passwords in internal database

• Hard-coded credentials

>=4.0.0, <4.0.3 || <3.0.15 · fixed in 4.0.3, 3.0.15

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata.

• Hard-coded credentials