61620 matches found
eNdonesia Portal SQL注入漏洞
eNdonesia Portal is a system platform developed by eNdonesia’s individual developers, offering functions for portal content management and information publishing. Version 8.7 of eNdonesia Portal has a SQL injection vulnerability. This vulnerability arises from injecting malicious code through...
Use of Hard-coded Credentials
Overview praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the authservice.py process when the JWT signing key defaults to a hardcoded value if the required environment...
Admidio writes session IDs and auto-login cookie values to application logs
Summary When debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live...
CVE-2026-4387
StrongDM Desktop Application before 23.74.0 Desktop Client before 53.77.0 on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\.sdm\state.kv. The file is protected only by default...
CVE-2026-9039
A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default...
CVE-2026-5065
IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...
CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...
CVE-2026-42941
The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change...
CVE-2026-42929
Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials...
Exploit for CVE-2026-46376
CVE-2026-46376 — FreePBX Unauthenticated UCP Access via Hard-C...
CVE-2026-7786
Jinan USR IOT Technology Limited PUSR USR-W610 RS232/485 to Wi-Fi/Ethernet Converter device firmware contains plaintext administrative credentials embedded in the firmware image. These credentials can be extracted through firmware analysis and used to authenticate to device services...
CVE-2026-45628
Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.29.2 and earlier, Dokploy constructs shell commands using JavaScript template literals and executes them via childprocess.exec which runs through /bin/sh -c. User-supplied branch names, repository URLs, and Docker credentials are...
EUVD-2026-33387
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names...
CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...
CVE-2026-49378
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...
CVE-2026-49378
JetBrains TeamCity prior to version 2026.1 exposes credentials parameters through parameter autocompletion. Affected product: TeamCity server. Root cause: credential values were surfaced in autocompletion UI, enabling potential disclosure. This entry provides no specific exploit details, affected...
EUVD-2026-33386
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion...
CVE-2026-49379
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names...
