CWE-798: Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
A kind of CWE-1391 Use of Weak Credentials.
From the CWE List. © The MITRE Corporation.
Newest
- wolfsoftwaresystemsltd wolfstackWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret9.3 Critical
- ibm i access client solutionsIBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities7.7 High
- quanovate tech inc. (operating as mira / mira care) mira android app, mira firmware +1 moreMira Hormone Monitor, Mira Android App Use of Hard-coded Credentials9.3 Critical
- dromara maxkeyMaxKey Hard-coded JWT Secret Unauthorized Access via /login/jwt/trust9.3 Critical
- sap se advanced planning and optimization (model mix planning)Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)3.8 Low
- tbea tlogger (tbea communication box 3rd generation)Backdoor / default root credentials9.3 Critical
- zyxel networks wah7601Hardcoded Credentials in Zyxel WAH7601 Router7.3 High
- zte f689Information leakage vulnerability in ZTE F689 product7.5 High
- djangocrm django-crmDjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery9.1 Critical
- No product listedMy Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication...9.8 Critical
- tp link systems inc. omada access points, tp-link omada ds1008x firmware, omada ds1016g firmware +114 more +116 moreHardcoded Certificates in TP-Link Omada Device Communications8.2 High
- andritz hipase-250, 250 scala +1 moreUse of hard-coded VNC credentials in the engineering-workstation provisioning8.1 High
- rich source dms+ (non-mobile)Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials10.0 Critical
- No product listedOutstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET...9.1 Critical
- an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execute arbitrary code on the server. koollab lmsHard-coded AWS IAM credentials vulnerability5.4 Medium
- ibm cloud pak systemDue to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []7.5 High
- tp link systems inc. tl-wr845n v4, tl-wr902ac v4, tp-link systems inc. archer c20 v6 +2 more +4 moreHardcoded Credential Vulnerability in Multiple TP-Link Router Models5.2 Medium
- ericsson packet core controller (pcc)Use of Hard-coded Credentials Vulnerability5.1 Medium
- joomshaper.com sp page builder extension for joomlaJoomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.19.8 Critical
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs...8.8 High
- quest kace systems management applianceAn issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs...8.8 High
- autel maxicharger single, maxicharger single charger firmware +1 moreBackdoor Authentication Token10.0 Critical
- autel maxicharger single, maxicharger single charger firmware +1 moreHard-coded / Backdoor Accounts10.0 Critical
- ibm langflow oss, langflow +1 moreLangflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints9.8 Critical
- pheditorPheditor: Hardcoded default password 'admin' with no forced change enables full application compromise9.8 Critical
- stratonwebdesigners hireflowHireFlow: Use of Hard-coded Credentials10.0 Critical
- No product listedAn issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote...5.7 Medium
- labring fastgptFastGPT: Unauthenticated cross-tenant data access via forgeable plugin-invoke JWT (default INVOKE_TOKEN_SECRET='token')8.8 High
- hkuds lightragLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection9.3 Critical
- dataeaseDataEase: Hardcoded JWT Signing Secret in ShareLink8.3 High
- No product listedTrueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability...9.8 Critical
- prog mis erp appPROG MIS｜ERP App - Use of Hard-coded Credentials9.3 Critical
- gardyn cloud api, home firmware, studio firmware +2 moreGardyn IoT Hub Use of Hard-coded Credentials9.5 Critical
- watchguard fireware, fireware os +1 moreWatchGuard Firebox Hardcoded Fallback Encryption Key in Access Portal Resource Credential Database5.9 Medium
- decolua 9router9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass9.8 Critical
- uvnc ultravncUltraVNC repeater ships hardcoded default admin password allowing unauthenticated admin access9.1 Critical
- stonefly storage concentrator, storage concentrator virtual machine +1 moreUse of Hard-coded Credentials in StoneFly Storage Concentrator9.3 Critical
- daktronics dmp-5000, dmp-5000 firmware, dmp-8000 +3 more +5 moreDaktronics Controller Firmware Use of Hard-coded Credentials9.3 Critical
- opf openprojectOpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`9.9 Critical
- ibm storage protect client, storage protect snapshot for windows, storage protect +2 moreHardcoded credential in the IBM Storage Protect Snapshot For Windows leads to unauthorized access to system9.1 Critical
- line corporation central dogmaCentral Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover9.4 Critical
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery9.8 Critical
- mervinpraison praisonai, praisonai-platform +1 morepraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)9.8 Critical
- bitnami bitnami/mariadb-galera, bitnami/mariadb-galera helm chart +1 moreDefault replication credential monitor:monitor created5.3 Medium
- bitnami bitnami/cassandraDefault superuser cassandra:cassandra left active when CASSANDRA_USER is customized9.8 Critical
- silver leaf technologies, inc. worksnaps.net worksnapsHardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources9.3 Critical
- mitsubishi electric corporation adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) hm-01a-ex, adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) p-01hma, adapters for airflow ventilation systems, heat pump chilled/hot water systems, and ventilation/air-conditioning system air resorts (for japan) p-hm02wa +2,477 more +2,479 moreInformation Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances7.2 High
- crawl4aiCrawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints9.2 Critical
- crawl4aiCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key9.3 Critical
- crawl4aiCrawl4AI - Arbitrary JavaScript Execution via /execute_js Endpoint9.2 Critical
- Show moreLoading…