CWE-798 · Use of Hard-coded Credentials (page 4)
Page 4 of 19 — CVEs classified under CWE-798, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36747 | Critical | 9.8 | 2025-12-13 | ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the ser… |
CVE-2025-14611 | Critical | 9.8 | 2025-12-12 | Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades secur… |
CVE-2025-54947 | Critical | 9.8 | 2025-12-12 | In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the… |
CVE-2025-65823 | Critical | 9.8 | 2025-12-10 | The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved t… |
CVE-2025-13954 | | 2025-12-10 | Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to t… | |
CVE-2025-41696 | Medium | 4.6 | 2025-12-09 | An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access… |
CVE-2025-40938 | High | 8.1 | 2025-12-09 | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). The affected device stores sensitive information in the firmware. This could al… |
CVE-2025-14126 | High | 8.8 | 2025-12-06 | A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulati… |
CVE-2025-65730 | High | 8.8 | 2025-12-05 | Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication. |
CVE-2025-66237 | Medium | 6.7 | 2025-12-04 | DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate priv… |
CVE-2025-29268 | Critical | 9.8 | 2025-12-04 | ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library. |
CVE-2025-64778 | High | 7.3 | 2025-12-02 | NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow una… |
CVE-2025-66454 | Medium | 6.5 | 2025-12-02 | Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worker secret ("dev") th… |
CVE-2025-54341 | Medium | 5.3 | 2025-11-24 | A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values. |
CVE-2018-25126 | | 2025-11-24 | Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains hardcoded API credentials and an OS com… | |
CVE-2025-63433 | Medium | 4.6 | 2025-11-24 | Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a stat… |
CVE-2025-59669 | Medium | 5.3 | 2025-11-18 | A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may a… |
CVE-2025-64766 | Medium | 5.3 | 2025-11-17 | NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to befo… |
CVE-2025-13252 | High | 7.3 | 2025-11-16 | A vulnerability was found in shsuishang ShopSuite ModulithShop up to 45a99398cec3b7ad7ff9383694f0b53339f2d35a. Affected by this issue is some unknown functiona… |
CVE-2025-33186 | High | 8.8 | 2025-11-11 | NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, an… |
CVE-2025-42890 | Critical | 10.0 | 2025-11-11 | SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the pos… |
CVE-2025-34501 | | 2025-11-03 | Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet… | |
CVE-2025-62777 | High | 8.8 | 2025-10-28 | Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affect… |
CVE-2025-41109 | Medium | 4.6 | 2025-10-22 | Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of… |
CVE-2025-41722 | High | 7.5 | 2025-10-22 | The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the S… |
CVE-2025-10639 | High | 8.8 | 2025-10-21 | The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network… |
CVE-2025-6950 | | 2025-10-17 | An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hard-coded secret ke… | |
CVE-2025-60639 | Medium | 6.5 | 2025-10-16 | Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26). |
CVE-2025-10850 | Critical | 9.8 | 2025-10-16 | The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded passwor… |
CVE-2025-56749 | Critical | 9.4 | 2025-10-15 | Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge vali… |
CVE-2025-36087 | High | 8.1 | 2025-10-13 | IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations… |
CVE-2025-11643 | Low | 3.7 | 2025-10-12 | A security flaw has been discovered in Tomofun Furbo 360 and Furbo Mini. Affected by this vulnerability is an unknown functionality of the file /squashfs-root/… |
CVE-2025-61926 | | 2025-10-09 | Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook… | |
CVE-2025-10609 | Medium | 5.9 | 2025-10-03 | Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects Tige… |
CVE-2025-0642 | Medium | 6.3 | 2025-10-02 | Use of Hard-coded Credentials, Authorization Bypass Through User-Controlled Key vulnerability in PosCube Hardware Software and Consulting Ltd. Co. Assist allow… |
CVE-2025-34223 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 (VA/SaaS deployments) contain… |
CVE-2025-34209 | High | 7.2 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker image… |
CVE-2025-34196 | Critical | 9.8 | 2025-09-29 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application prior to 25.1.1413 (Windows client deployments) contain… |
CVE-2025-11126 | Critical | 9.8 | 2025-09-29 | A security flaw has been discovered in Apeman ID71 218.53.203.117. This vulnerability affects unknown code of the file /system/www/system.ini. The manipulation… |
CVE-2025-58385 | High | 7.1 | 2025-09-26 | In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data). |
CVE-2025-58659 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a th… |
CVE-2025-58656 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retri… |
CVE-2025-58269 | Medium | 5.3 | 2025-09-22 | Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP P… |
CVE-2025-57434 | High | 8.8 | 2025-09-22 | Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username… |
CVE-2025-57602 | Critical | 9.8 | 2025-09-22 | Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows rem… |
CVE-2025-57601 | Critical | 9.8 | 2025-09-22 | AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/edge devices. When a… |
CVE-2025-52159 | High | 8.8 | 2025-09-19 | Hardcoded credentials in default configuration of PPress 0.0.9. |
CVE-2025-34198 | Critical | 9.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 (VA and SaaS deployments) contain sha… |
CVE-2025-34197 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an und… |
CVE-2024-48842 | High | 7.0 | 2025-09-17 | Use of Hard-coded Credentials vulnerability in ABB FLXEON.This issue affects FLXEON: through 9.3.5 and newer versions |
CVE-2025-57579 | High | 8.0 | 2025-09-12 | An issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default password |
CVE-2025-57578 | High | 8.0 | 2025-09-12 | An issue in H3C Magic M Device M2V100R006 allows a remote attacker to execute arbitrary code via the default password |
CVE-2025-57577 | High | 8.0 | 2025-09-12 | An issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password. NOTE: the Supplier's position is that their "p… |
CVE-2025-8570 | Critical | 9.8 | 2025-09-11 | The BeyondCart Connector plugin for WordPress is vulnerable to Privilege Escalation due to improper JWT secret management and authorization within the determin… |
CVE-2025-56466 | High | 7.5 | 2025-09-10 | Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information. |
CVE-2025-55047 | High | 8.4 | 2025-09-09 | CWE-798 Use of Hard-coded Credentials |
CVE-2025-35452 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative web interface. |
CVE-2025-35451 | Critical | 9.8 | 2025-09-05 | PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many… |
CVE-2025-30200 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived. |
CVE-2025-30198 | Medium | 6.3 | 2025-09-05 | ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived. |
CVE-2025-55739 | | 2025-09-05 | api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17… | |
CVE-2025-9696 | | 2025-09-02 | The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker… | |
CVE-2025-9806 | Low | 1.9 | 2025-09-02 | A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administra… |
CVE-2025-9778 | Low | 1.9 | 2025-09-01 | A security vulnerability has been detected in Tenda W12 up to 3.0.0.6(3948). Affected is an unknown function of the file /etc_ro/shadow of the component Admini… |
CVE-2025-9731 | Low | 2.5 | 2025-08-31 | A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative… |
CVE-2025-9725 | Low | 2.5 | 2025-08-31 | A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interfac… |
CVE-2025-8857 | Critical | 9.8 | 2025-08-29 | Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator… |
CVE-2025-9380 | High | 7.8 | 2025-08-24 | A vulnerability was identified in FNKvision Y215 CCTV Camera 10.194.120.40. Affected by this issue is some unknown functionality of the file /etc/passwd of the… |
CVE-2025-51606 | High | 8.8 | 2025-08-21 | hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. This allows attackers with access to the source code or compiled bin… |
CVE-2025-9310 | Medium | 5.3 | 2025-08-21 | A vulnerability was determined in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-9309 | Low | 2.5 | 2025-08-21 | A vulnerability was found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /etc_ro/shadow of the component MD5 Hash Handler. Performing m… |
CVE-2025-33100 | Medium | 6.2 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2025-7342 | High | 7.5 | 2025-08-17 | A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nut… |
CVE-2025-9091 | Low | 2.5 | 2025-08-17 | A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manip… |
CVE-2025-8974 | Low | 3.7 | 2025-08-14 | A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/ja… |
CVE-2025-43982 | Critical | 9.8 | 2025-08-13 | Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be… |
CVE-2025-55279 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could e… | |
CVE-2025-54465 | | 2025-08-13 | This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with phys… | |
CVE-2025-3831 | High | 8.1 | 2025-08-12 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. |
CVE-2025-26398 | Medium | 5.6 | 2025-08-12 | SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-m… |
CVE-2025-8730 | Critical | 9.8 | 2025-08-08 | A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-7768 | | 2025-08-06 | Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerabili… | |
CVE-2025-54872 | | 2025-08-06 | onion-site-template is a complete, scalable tor hidden service self-hosting sample. Versions which include commit 3196bd89 contain a baked-in tor image if the… | |
CVE-2025-8530 | Medium | 5.3 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the f… |
CVE-2025-38741 | High | 7.5 | 2025-08-04 | Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this v… |
CVE-2025-26476 | High | 8.4 | 2025-08-04 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with… |
CVE-2025-51536 | Critical | 9.8 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password. |
CVE-2025-44643 | High | 8.6 | 2025-08-04 | Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password pr… |
CVE-2025-37112 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exp… |
CVE-2025-37111 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful… |
CVE-2014-125121 | | 2025-07-31 | Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation vulnerability caused by a combination of h… | |
CVE-2025-30125 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an in… |
CVE-2025-8231 | Medium | 6.8 | 2025-07-27 | A vulnerability, which was classified as critical, has been found in D-Link DIR-890L up to 111b04. This issue affects some unknown processing of the file rgbin… |
CVE-2025-45466 | High | 8.8 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. |
CVE-2014-125115 | | 2025-07-25 | An unauthenticated SQL injection vulnerability exists in Pandora FMS version 5.0 SP2 and earlier. The mobile/index.php endpoint fails to properly sanitize user… | |
CVE-2025-31953 | High | 7.1 | 2025-07-24 | HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties. |
CVE-2025-54455 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-54454 | Critical | 9.1 | 2025-07-23 | Use of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less… |
CVE-2025-4130 | High | 7.5 | 2025-07-21 | Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13… |
CVE-2025-4570 | | 2025-07-21 | An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with c… |