GitLab CE/EE - Hard-Coded Credentials

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

CVE-2023-41508

CVE-2023-41508 CVE-2023-41508 - Una contraseña codificada en el código de Super Store Finder v3.6 permite a los atacantes acceder al panel de administración. Tipo de vulnerabilidad Control de acceso incorrecto Proveedor del producto Super Store Finder Base de código del producto afectado Super...

CVE-2017-6640-POC

CVE-2017-6640-POC Proof of concept for CVE-2017-6640 as burp extension Cisco Prime Data Center Network Manager DCNM implements a static credentials. See also: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-dcnm2 More specifically, the Web UI requires users...

ccs

Escáner de Credenciales en Código Este script está diseñado para escanear una base de código grande y diversa en busca de credenciales codificadas, o credenciales presentes en archivos de configuración. Estas representan un grave problema de seguridad y pueden ser extremadamente difíciles de...

CVE-2024-22734

CVE-2024-22734 Exploit PoC for CVE-2024-22734 This repository contains the exploit source Proof of Concept PoC for CVE-2024-22734 , a vulnerability discovered by Bryan Smith of Redline Cyber Security. For detailed information about the vulnerability, please refer to our blog post: CVE-2024-22734:...

CVE-2026-13768

CVE-2026-13768: Credencial Privilegiada de IoT Hub — Enumeración de Flota, RCE en Dispositivos y Pivote en la Red Doméstica Aviso Campo| Valor ---|--- CVE| CVE-2026-13768 ICSA| ICSA-26-183-03 Gardyn IoT Hub CVSS 3.1| 10.0 Crítico Vector 3.1| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L Vector 4.0...

CVE-2026-90945 Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2026-90945

Crawlab versions through 0.6.3 contain a critical authentication bypass caused by a hard-coded HMAC-SHA256 secret used for JWT token signing. Because the secret cannot be overridden via configuration or environment variables, an unauthenticated network attacker can forge valid administrator token...

EUVD-2026-77712

Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that cannot be overridden via configuration or environment variables. Unauthenticated attackers can forge valid administrator tokens to access administrative APIs and execute code on worker nodes...

CVE-2022-42176

PCSecure V5.0.8.xw - El uso de credenciales codificadas en archivos de configuración permite el acceso al panel de administración Resumen Proveedor: PCTechSoft SAS Producto: PCSecure Versiónes afectadas: 5.0.8.xw Nombre clave: PapiQuieroPollo00 Vulnerabilidad Tipo: Uso de credenciales codificadas...

CVE-2025-70962

CVE-2025-70962 Uso de credenciales codificadas en el servicio RTSP de la cámara IP ZOSI C519M Campo| Valor ---|--- ID CVE| CVE-2025-70962 Fabricante| ZOSI Technology Producto| Cámara IP inteligente ZOSI C519M también listada como modelo 1NC-519M Versiones afectadas| Firmware V4.2.8.832C01450BA...

EVlink City < R8 V3.4.0.1 - Authentication Bypass

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

CVE-2026-90510

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90509

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

CVE-2026-90510

dromara orion-visor (up to version 2.5.7) contains a hard-coded AES cryptographic key in the HostKeyServiceImpl.encryptKey function within the asset-service module. This CWE-321 flaw allows a remote attacker, with no privileges or user interaction, to decrypt SSH private keys and host passwords s...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90510 dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded key

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

EUVD-2026-76983

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file...

CVE-2026-90509

A hard-coded credential weakness (CWE-798) exists in dromara orion-visor versions up to 2.5.7 , specifically in the function ExposeApiAspect.beforeExposeApi within ExposeApiAspect.java. The vulnerability allows a remote, unauthenticated attacker to exploit a hardcoded default token for authentica...