CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- crawl4aiCrawl4AI - Stored Cross-Site Scripting in Monitor Dashboard5.3 Medium
- crawl4aiCrawl4AI - Unauthenticated Access to Monitor Endpoints via Docker API Server6.9 Medium
- crawl4aiCrawl4AI - Server-Side Request Forgery via Webhook URLs9.2 Critical
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Parameter8.8 High
- radiflow isap smart collectorUse of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector8.6 High
- canon eos network setting tool, canon inc. eos network setting tool for macos, eos network setting tool for windows +2 moreUse of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier6.9 Medium
- aqara com.lumiunited.aqarahome, home +1 moreAqara Home Android SDK hardcoded keys9.1 Critical
- aqara aquara iam/sso gateway, iam\/sso gateway +1 moreAqara hardcoded OAuth client credentials9.1 Critical
- yarbo android/ios mobile application, cloud mqtt infrastructure +1 moreYarbo Android/iOS Mobile Application and Cloud Infrastructure Use of Hard-coded Credentials9.3 Critical
- iei integration corp irm-tsi410xIEI Integration Corp｜iRM-IEI Remote Management - Hard-coded Credentials9.3 Critical
- dhax go-baseGo Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery9.1 Critical
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability9.6 Critical
- altium enterprise server, on-prem enterprise server +1 moreUnauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Traversal10.0 Critical
- riello netman 204NetMan 204 Hard-coded Backdoor Credentials9.3 Critical
- navtor navbox, navbox firmware +1 moreNAVTOR NavBox Use of Hard-coded Credentials5.8 Medium
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreBulk User Private Data Harvesting8.7 High
- acer connect m6e 5g portable wifi router, connect m6e 5g firmware +1 moreHard-coded AWS Cognito Testing Accounts6.9 Medium
- securly, securly chrome extension +1 moreCVE-2026-88767.3 High
- No product listedMercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 contains hardcoded WiFi driver...5.9 Medium
- No product listedMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups...7.1 High
- dräger sc 6002xl, sc 7000, sc6802xl +2 more +4 moreDräger SC Monitoring Devices Hard-coded Credentials and DoS7.2 High
- kamsoft ks-somedHard-coded credentials in KS-SOMED8.7 High
- trac d.o.o. pdbmCredential Exposure Vulnerability in Trac PDBM6.4 Medium
- apache solrApache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users8.1 High
- mervinpraison praisonai-platformpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset9.8 Critical
- agenticmail @agenticmail/api, @agenticmail/core +1 moreAgenticMail API/storage and outbound relay hardening8.2 High
- danelec macgregor voyage data recorder (vdr) g4e, macgregor interschalt vdr g4e firmware +1 moreMacGregor Voyage Data Recorder (VDR) G4e Use of Hard-coded Credentials8.7 High
- jinan usr iot technology limited (pusr) usr-w610 rs232/485 to wi-fi/ethernet converterJinan USR IOT Technology Limited (PUSR) USR-W610 RS232/485 to Wi-Fi/Ethernet Converter Use of Hard-coded Credentials9.8 Critical
- dokployDokploy: Pre-Auth Admin Takeover via Hardcoded Authentication Secret10.0 Critical
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface9.3 Critical
- indian motorcycle scout bobber + techIndian Scout Bobber 2025 WCM-to-ECM weak authentication4.1 Medium
- acer wave 7 router, wave 7 firmware +1 moreAcer Wave 7 router: Hardcoded Cryptographic Key10.0 Critical
- rustfsRustFS: Internode RPC HMAC secret falls back to public default credential, enabling peer impersonation9.8 Critical
- sdmc ne6037SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php9.3 Critical
- ibm controllerIBM Controller is affected by vulnerabilities8.8 High
- No product listedNetis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow...7.3 High
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in tables.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded Google Maps API Key in settings.inc.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded WhitePages API Key in wp1.php6.9 Medium
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.php9.2 Critical
- open ises ticketsOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.php9.2 Critical
- taiko network communications pte ltd. ag1000-01a sms alert gatewayTaiko AG1000-01A Rev 7.3/8 Hard-coded Credentials via login.zhtml9.3 Critical
- scadabrUse of Hard-coded Credentials in ScadaBR5.1 Medium
- comarch erp optimaHardcoded credentials in Comarch ERP Optima8.7 High
- www.huawei.com hg630 v2 routerHuawei HG630 V2 Router Authentication Bypass via Serial Number8.7 High
- siemens teamcenter, teamcenter v2312, teamcenter v2406 +3 more +5 moreA vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter...8.7 High
- socfortress copilotSOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools10.0 Critical
- dell ecs, objectscale, elastic cloud storage +2 moreDell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0,...9.8 Critical
- yeti-platform yetiyeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens is the secret is not changed (by setting YETI_AUTH_SECRET_KEY to a value other than SECRET).7.5 High
- yarbo firmware, lawn mower firmware, lawn mower pro firmware +2 moreHardcoded credentials in Yarbo robot firmware9.8 Critical
- Show moreLoading…