CWE-259
CVEs classified under CWE-259, newest first.
33 CVEsRSS
CVE-2026-113736Critical· 9.8D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password
A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads…
CVE-2026-112146High· 7.4PoCD-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /etc/emDaemon/passwd of the component MQTT Broker. The manipulation results in hard-coded credentials. It is possible to…
CVE-2026-110667High· 7.3A security flaw has been discovered in cemtan sar2html 4.0.0
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack c…
CVE-2026-108831Medium· 6.3A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2
A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The …
CVE-2026-108584Medium· 5.3PoCA security flaw has been discovered in FunnyWolf Viper up to 3.1.11
A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the…
CVE-2026-105147High· 7.3PoCA vulnerability was determined in SciPhi-AI R2R up to 3.6.6
A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULT_BCRYPT_SECRET_KEY/DEFAULT_NACL_SECRET_KEY causes hard-coded credenti…
CVE-2026-105141Medium· 6.3A security flaw has been discovered in topoteretes cognee up to 1.5.4
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Han…
CVE-2026-70413Medium· 5.6Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability
Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
CVE-2026-101052High· 7.3PoCA security vulnerability has been detected in refly-ai refly up to 1.1.0
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the inpu…
CVE-2026-97877High· 7.3PoCA vulnerability was determined in zhistaredu StarTraining up to 3.8.1
A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id…
CVE-2026-96548Medium· 5.6PoCA flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is poss…
CVE-2026-65117Medium· 5.0NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information d…
CVE-2026-93970High· 7.3A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1
A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials.…
CVE-2026-93969High· 7.3A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1
A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be c…
CVE-2026-90509High· 7.3PoCA weakness has been identified in dromara orion-visor up to 2.5.7
A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The …
CVE-2026-71809High· 8.1PoCAuthentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator.
Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticated attackers to log in as any user, merchant, or administrator.
CVE-2026-86673High· 7.3PoCA vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf
A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connec…
CVE-2026-86276High· 7.3PoCA flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0
A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack…
CVE-2026-86150Medium· 4.1A security vulnerability has been detected in Tenda CP3 27.5.57.101
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be…
CVE-2026-70403Critical· 9.8XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259)
XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device.
CVE-2026-78062High· 7.3A vulnerability was identified in vas3k TaxHacker up to 0.8.2
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads …
CVE-2026-23933Critical· 9.1In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest…
CVE-2026-19901High· 8.1A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206
A security flaw has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. It is possible to launch the attack remotely. At…
CVE-2026-19900High· 8.1PoCA vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206
A vulnerability was identified in LB-LINK X-PRO 1.0.22-20231206. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. A hig…
CVE-2026-20316Medium· 5.3CISA KEV0dayPoCA vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within…
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within…
CVE-2026-22055High· 8.8Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Active IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
CVE-2026-22054High· 8.8Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
CVE-2025-57175Medium· 6.4Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.
Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.
CVE-2025-14126High· 8.8A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06
A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulation leads to hard-coded credentials. The attack needs to be initiated within th…
CVE-2025-11666Medium· 6.7A flaw has been found in Tenda RP3 Pro up to 22.5.7.93
A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler. Executing manipulation of the argument current_force_upgrade_pwd can lead to …