CWE-798 · Use of Hard-coded Credentials (page 4)
Page 4 of 18 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3831 | High | 8.1 | 2025-08-12 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. |
CVE-2025-26398 | Medium | 5.6 | 2025-08-12 | SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-m… |
CVE-2025-8730 | Critical | 9.8 | 2025-08-08 | A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-7768 | | 2025-08-06 | Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerabili… | |
CVE-2025-54872 | | 2025-08-06 | onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the… | |
CVE-2025-8530 | Medium | 5.3 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the f… |
CVE-2025-38741 | High | 7.5 | 2025-08-04 | Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this v… |
CVE-2025-26476 | High | 8.4 | 2025-08-04 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with… |
CVE-2025-51536 | Critical | 9.8 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password. |
CVE-2025-44643 | High | 8.6 | 2025-08-04 | Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password pr… |
CVE-2025-37112 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exp… |
CVE-2025-37111 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful… |
CVE-2014-125121 | | 2025-07-31 | Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of h… | |
CVE-2025-30125 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an in… |
CVE-2025-8231 | Medium | 6.8 | 2025-07-27 | A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04. This issue affects some unknown processing of the file rgbin… |
CVE-2025-45466 | High | 8.8 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. |
CVE-2014-125115 | | 2025-07-25 | An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user… | |
CVE-2025-31953 | High | 7.1 | 2025-07-24 | HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties. |
CVE-2025-54455 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-54454 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-4130 | High | 7.5 | 2025-07-21 | Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13… |
CVE-2025-4570 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4569 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… | |
CVE-2025-4049 | | 2025-07-21 | Use of hard-coded, the same among all vulnerable installations SQLite credentials vulnerability in SIGNUM-NET FARA allows to read and manipulate local-stored d… | |
CVE-2025-6982 | | 2025-07-16 | Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20 V5 (<US_V5_260419 or <EU_V5_260317) all… | |
CVE-2025-53754 | | 2025-07-16 | This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker w… | |
CVE-2025-53842 | Medium | 4.5 | 2025-07-16 | Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions. If this vulnerability is exploited, an… |
CVE-2025-52376 | Critical | 9.8 | 2025-07-15 | An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an… |
CVE-2025-3621 | Critical | 9.6 | 2025-07-15 | Vulnerabilities* in ActADUR local server product, developed and maintained by ProTNS, allows Remote Code Inclusion on host systems. * vulnerabilities: *… |
CVE-2025-52363 | Medium | 6.8 | 2025-07-14 | Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware ima… |
CVE-2025-7564 | High | 7.8 | 2025-07-14 | A vulnerability, which was classified as critical, has been found in LB-LINK BL-AC3600 1.0.22. Affected by this issue is some unknown functionality of the file… |
CVE-2024-38648 | Medium | 5.7 | 2025-07-12 | A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials. |
CVE-2025-7503 | | 2025-07-11 | An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The… | |
CVE-2025-7401 | Critical | 9.8 | 2025-07-11 | The Premium Age Verification / Restriction for WordPress plugin for WordPress is vulnerable to arbitrary file read and write due to the existence of an insuffi… |
CVE-2025-5023 | High | 7.1 | 2025-07-10 | Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA… |
CVE-2025-49551 | High | 8.8 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Use of Hard-coded Credentials vulnerability that could result in privilege escalatio… |
CVE-2025-37103 | Critical | 9.8 | 2025-07-08 | Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authenticati… |
CVE-2025-52492 | High | 7.5 | 2025-07-07 | A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for th… |
CVE-2025-7079 | Low | 3.7 | 2025-07-06 | A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the fil… |
CVE-2025-45813 | Critical | 9.8 | 2025-07-02 | ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials. |
CVE-2025-20309 | Critical | 10.0 | 2025-07-02 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2025-4378 | Critical | 10.0 | 2025-06-24 | Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentica… |
CVE-2025-34034 | High | 8.8 | 2025-06-24 | A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known defaul… |
CVE-2025-45784 | Critical | 9.8 | 2025-06-18 | D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive user credentials. An… |
CVE-2025-34509 | High | 7.5 | 2025-06-17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, an… |
CVE-2025-28388 | Critical | 9.8 | 2025-06-13 | OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. |
CVE-2025-35940 | High | 8.1 | 2025-06-10 | The ArchiverSpaApi ASP.NET application uses a hard-coded JWT signing key. An unauthenticated remote attacker can generate and use a verifiable JWT token to ac… |
CVE-2025-5751 | Medium | 6.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers t… |
CVE-2025-3321 | | 2025-06-06 | A predefined administrative account is not documented and cannot be deactivated. This account cannot be misused from the network, only by local users on the se… | |
CVE-2025-5379 | Medium | 4.3 | 2025-05-31 | A vulnerability classified as critical was found in NuCom NC-WR744G 8.5.5 Build 20200530.307. This vulnerability affects unknown code of the component Console… |
CVE-2025-4633 | Medium | 6.5 | 2025-05-30 | Default credentials were present in the web portal for Airpointer 2.4.107-2, allowing an unauthenticated malicious actor to log in via the web portal |
CVE-2025-48491 | | 2025-05-30 | Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been p… | |
CVE-2025-46352 | Critical | 9.8 | 2025-05-30 | The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running V… |
CVE-2025-48748 | Critical | 10.0 | 2025-05-29 | Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password. |
CVE-2025-36572 | Medium | 6.5 | 2025-05-28 | Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. A low privileged attacker with rem… |
CVE-2025-5164 | Low | 3.7 | 2025-05-26 | A vulnerability has been found in PerfreeBlog 4.0.11 and classified as problematic. This vulnerability affects the function JwtUtil of the component JWT Handle… |
CVE-2025-41380 | | 2025-05-23 | Iridium Certus 700 version 1.0.1 has an embedded credentials vulnerability in the code. This vulnerability allows a local user to retrieve the SSH hash string. | |
CVE-2025-2394 | | 2025-05-23 | Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leadi… | |
CVE-2025-48414 | Medium | 6.5 | 2025-05-21 | There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administra… |
CVE-2025-48413 | High | 7.7 | 2025-05-21 | The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update f… |
CVE-2025-45746 | Medium | 6.5 | 2025-05-13 | In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Su… |
CVE-2025-27488 | Medium | 6.7 | 2025-05-13 | Use of hard-coded credentials in Windows Hardware Lab Kit allows an authorized attacker to elevate privileges locally. |
CVE-2025-47730 | Medium | 4.8 | 2025-05-08 | The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive Signal) app with the… |
CVE-2025-20188 | Critical | 10.0 | 2025-05-07 | A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles features of Cisco IOS XE So… |
CVE-2025-4041 | | 2025-05-06 | In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components t… | |
CVE-2025-32889 | High | 7.3 | 2025-05-01 | An issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTenna server is hardc… |
CVE-2025-32888 | High | 7.3 | 2025-05-01 | An issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goTenna server is har… |
CVE-2025-23179 | Medium | 5.5 | 2025-04-29 | CWE-798: Use of Hard-coded Credentials |
CVE-2024-13688 | Medium | 5.3 | 2025-04-28 | The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass… |
CVE-2025-32985 | Critical | 9.8 | 2025-04-25 | NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files. |
CVE-2025-46617 | High | 7.2 | 2025-04-25 | Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration paramet… |
CVE-2025-46274 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database. |
CVE-2025-46273 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices. |
CVE-2025-2765 | High | 8.8 | 2025-04-23 | CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypa… |
CVE-2025-28230 | Critical | 9.1 | 2025-04-18 | Incorrect access control in JMBroadcast JMB0150 Firmware v1.0 allows attackers to access hardcoded administrator credentials. |
CVE-2024-41794 | Critical | 10.0 | 2025-04-08 | A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for remote access to the… |
CVE-2025-3426 | | 2025-04-07 | We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfusc… | |
CVE-2025-30406 | Critical | 9.0 | 2025-04-03 | Gladinet CentreStack through 16.1.10296.56315 (fixed in 16.4.10315.56368) has a deserialization vulnerability due to the CentreStack portal's hardcoded machine… |
CVE-2025-30118 | High | 7.5 | 2025-03-25 | An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all d… |
CVE-2025-2538 | Critical | 9.8 | 2025-03-20 | A hardcoded credential vulnerability exists in a specific deployment pattern for Esri Portal for ArcGIS versions 11.4 and below that may allow a remote unauthe… |
CVE-2025-2556 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video… |
CVE-2025-30137 | Critical | 9.8 | 2025-03-18 | An issue was discovered in the G-Net GNET APK 2.6.2. Hardcoded credentials exist in in APK for ports 9091 and 9092. The GNET mobile application contains hardco… |
CVE-2025-30123 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. The mobile app APK (Viidure) contains hardcoded FTP credentials for the FTPX user account, enabling attackers to… |
CVE-2025-30122 | Critical | 9.8 | 2025-03-18 | An issue was discovered on ROADCAM X3 devices. It has a uniform default credential set that cannot be modified by users, making it easy for attackers to gain u… |
CVE-2025-30113 | Critical | 9.8 | 2025-03-18 | An issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Hardcoded Credentials exist in the APK for Ports 9091 and 9092. The dashcam's Androi… |
CVE-2025-30109 | Medium | 6.5 | 2025-03-18 | In the IROAD APK 5.2.5, there are Hardcoded Credentials in the APK for ports 9091 and 9092. The mobile application for the dashcam contains hardcoded credentia… |
CVE-2021-22126 | Medium | 6.7 | 2025-03-17 | A use of hard-coded password vulnerability in FortiWLC version 8.5.2 and below, version 8.4.8 and below, version 8.3.3 to 8.3.2, version 8.2.7 to 8.2.6 may all… |
CVE-2019-17659 | Low | 3.7 | 2025-03-17 | A use of hard-coded cryptographic key vulnerability in FortiSIEM version 5.2.6 may allow a remote unauthenticated attacker to obtain SSH access to the supervis… |
CVE-2025-1724 | High | 7.4 | 2025-03-17 | Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardco… |
CVE-2025-2343 | High | 7.5 | 2025-03-16 | A vulnerability classified as critical was found in IROAD Dash Cam X5 and Dash Cam X6 up to 20250308. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-2342 | Medium | 5.3 | 2025-03-16 | A vulnerability classified as critical has been found in IROAD X5 Mobile App up to 5.2.5 on Android. Affected is an unknown function of the component API Endpo… |
CVE-2025-2322 | High | 7.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt… |
CVE-2024-13773 | High | 7.3 | 2025-03-14 | The Civi - Job Board & Freelance Marketplace WordPress Theme plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in… |
CVE-2025-27255 | High | 8.0 | 2025-03-10 | Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcod… |
CVE-2025-1393 | Critical | 9.8 | 2025-03-05 | An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected product. |
CVE-2025-27643 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006. |
CVE-2025-1879 | Low | 2.4 | 2025-03-03 | A vulnerability was found in i-Drive i11 and i12 up to 20250227 and classified as problematic. This issue affects some unknown processing of the component APK… |
CVE-2025-25570 | Critical | 9.8 | 2025-02-27 | Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. |
CVE-2024-9334 | High | 8.2 | 2025-02-27 | Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authenti… |
CVE-2024-57040 | Critical | 9.8 | 2025-02-26 | TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account… |