Base de CVEs

CVE-2025-65730 Alta · 8.8 CWE-798 05/12/2025

Use of Hard-coded Credentials em Pommee Goaway

Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.

CVE-2025-66237 Média · 6.7 CWE-798 04/12/2025

Sunbird DCIM dcTrack and Power IQ Use of Hard-coded Credentials

DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.

CVE-2025-29268 Crítica · 9.8 CWE-798 04/12/2025

Use of Hard-coded Credentials em Allnet All-rut22gw Firmware

ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

CVE-2025-64778 Alta · 7.8 CWE-798 02/12/2025

Mirion Medical EC2 Software NMIS BioDose Use of Hard-coded Credentials

NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. These hard-coded passwords could allow unauthorized access to both the application and database.

CVE-2025-54341 Média · 5.3 CWE-798 24/11/2025

Use of Hard-coded Credentials em Desktopalert Pingalert Application Server

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Hard-coded configuration values.

CVE-2025-63433 Média · 4.6 CWE-798 24/11/2025

Use of Hard-coded Credentials em Xtooltech Xtool Anyscan

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt update metadata. The key is stored as a static value within the application's code. An attacker with the ability to intercept network traffic can use this hardcoded key to decrypt, modify, and re-encrypt the update manifest, allowing them to direct the application to download a malicious update package.

CVE-2025-59669 Média · 5.5 CWE-798 18/11/2025

A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all...

A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow an authenticated attacker with shell access to the device to connect to redis service and access its data

CVE-2025-64766 Média · 5.3 CWE-798 17/11/2025

NixOS has hardcoded credentials in Onlyoffice module

NixOS's Onlyoffice is a software suite that offers online and offline tools for document editing, collaboration, and management. In versions from 22.11 to before 25.05 and versions before Unstable 25.11, a hard-coded secret was used in the NixOS module for the OnlyOffice document server to protect its file cache. An attacker with knowledge of an existing revision ID could use this secret to obtain a document. In practice, an arbitrary revision ID should be hard to obtain. The primary impact is likely the access to known documents from users with expired access. This issue was resolved in NixOS unstable version 25.11 and version 25.05.

CVE-2025-33186 Alta · 8.8 CWE-798 11/11/2025

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability...

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering.

CVE-2025-42890 Crítica · 10.0 CWE-798 10/11/2025

Insecure key & Secret Management vulnerability in SQL Anywhere Monitor (Non-Gui)

SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and availability of the system.

CVE-2025-34501 Alta · 7.0 CWE-798 03/11/2025

Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services

Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services (SSH, HTTP, Telnet, SMB, X11) are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as connecting to the USB or Ethernet ports beneath the table - the built-in credentials permit administrative login and full control of the system. Once authenticated, an attacker can access firmware utilities, modify controller software, and establish persistent compromise. Remote attack paths via network, cellular, or telemetry links may exist in specific configurations but generally require additional capabilities or operator error. The vendor reports that USB access has been disabled in current firmware builds.

CVE-2025-62777 Alta · 8.8 CWE-798 28/10/2025

Use of Hard-coded Credentials em PLANEX COMMUNICATIONS INC. MZK-DP300N

Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affected device via Telnet and execute arbitrary commands.

CVE-2025-41109 Média · 4.6 CWE-798 22/10/2025

Use of Hard-coded Credentials vulnerability in Ghost Robotics' Vision 60

Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port. The vulnerability is due to the lack of authentication mechanisms when establishing connections through these ports. Specifically, with regard to network connectivity, the robot's internal router automatically assigns IP addresses to any device physically connected to it. An attacker could connect a WiFi access point under their control to gain access to the robot's network without needing the credentials for the deployed network. Once inside, the attacker can monitor all its data, as the robot runs on ROS 2 without authentication by default.

CVE-2025-41722 Alta · 7.5 CWE-798 22/10/2025

Sauter: Hard-coded Authentication Credentials

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

CVE-2025-10639 Alta · 8.8 CWE-798 21/10/2025

Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional

The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code execution as NT Authority\SYSTEM on the server by exchanging accessible service binaries in the WorkExaminer installation directory (e.g. "C:\Program File (x86)\Work Examiner Professional Server").

CVE-2025-6950 Crítica · 9.9 CWE-798 17/10/2025

Appliances de segurança e roteadores Moxa: chave JWT embutida no produto (CVE-2025-6950)

Foi identificada uma vulnerabilidade de Uso de Credenciais Codificadas (Hard-coded) nos appliances de segurança de rede e roteadores da Moxa. O sistema emprega uma chave secreta codificada para assinar JSON Web Tokens (JWT) usados na autenticação. Essa implementação insegura permite que um atacante não autenticado forje tokens válidos, contornando os controles de autenticação e se passando por qualquer usuário. A exploração pode resultar em comprometimento completo do sistema, possibilitando acesso não autorizado, roubo de dados e controle administrativo total sobre o dispositivo afetado. Embora a exploração bem-sucedida possa afetar gravemente a confidencialidade, a integridade e a disponibilidade do próprio dispositivo afetado, não há perda de confidencialidade ou integridade em sistemas subsequentes.

CVE-2025-60639 Média · 6.5 CWE-798 16/10/2025

Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).

CVE-2025-10850 Crítica · 9.8 CWE-798 16/10/2025

Felan Framework <= 1.1.4 - Hardcoded Credentials

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fb_ajax_login_or_register' function and in the 'google_ajax_login_or_register' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they registered with facebook or google social login and did not change their password. CVE-2025-23504 is likely a duplicate of this issue.

CVE-2025-56749 Crítica · 9.4 CWE-798 15/10/2025

Use of Hard-coded Credentials em Creativeitem Academy Lms

Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account.

CVE-2025-36087 Crítica · 9.8 CWE-798 12/10/2025

IBM Security Verify Access hard coded credentials

IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Access Container 10.0.0 through 10.0.9, and 11.0.0, under certain configurations, contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVE-2025-10609 Média · 5.9 CWE-798 03/10/2025

Hardcoded Credentials in Logo Software's TigerWings ERP

Use of Hard-coded Credentials vulnerability in Logo Software Inc. TigerWings ERP allows Read Sensitive Constants Within an Executable. This issue affects TigerWings ERP: from 01.01.00 before 3.03.00.

CVE-2025-34209 Alta · 7.2 CWE-798 29/09/2025

Vasion Print (formerly PrinterLogic) Hardcoded GPG Private Key

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and SaaS deployments) contain Docker images with the private GPG key and passphrase for the account *no‑reply+virtual‑appliance@printerlogic.com*. The key is stored in cleartext and the passphrase is hardcoded in files. An attacker with administrative access to the appliance can extract the private key, import it into their own system, and subsequently decrypt GPG-encrypted files and sign arbitrary firmware update packages. A maliciously signed update can be uploaded by an admin‑level attacker and will be executed by the appliance, giving the attacker full control of the virtual appliance. This vulnerability has been identified by the vendor as: V-2023-010 — Hardcoded Private Key.

CVE-2025-58659 Média · 5.3 CWE-798 22/09/2025

WordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerability

Use of Hard-coded Credentials vulnerability in Essekia Helpie FAQ helpie-faq allows Retrieve Embedded Sensitive Data.This issue affects Helpie FAQ: from n/a through <= 1.45.

CVE-2025-58656 Média · 5.3 CWE-798 22/09/2025

WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure Vulnerability

Use of Hard-coded Credentials vulnerability in Risto Niinemets Estonian Shipping Methods for WooCommerce estonian-shipping-methods-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Estonian Shipping Methods for WooCommerce: from n/a through <= 1.7.2.

CVE-2025-58269 Média · 5.3 CWE-798 22/09/2025

WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure Vulnerability

Use of Hard-coded Credentials vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 2.6.25.