316 matches found
CVE-2025-56749
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account...
PT-2025-42362
Name of the Vulnerable Software and Affected Versions Creativeitem Academy LMS versions up to and including 6.14 Description The software uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and...
CVE-2025-56749
Creativeitem Academy LMS versions up to and including 6.14 are vulnerable to an authentication bypass due to the use of a hardcoded default JWT secret for token signing. This predictable secret allows an attacker to forge valid JWT tokens, granting unauthorized access to any user account. To reme...
CVE-2025-56749
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account...
EUVD-2018-5755
Malware in sbrugna...
EUVD-2017-16550
Malware in sbrugna...
EUVD-2025-12378
Malicious code in bioql PyPI...
EUVD-2022-0108
Malicious code in bioql PyPI...
EUVD-2024-54777
Malicious code in bioql PyPI...
EUVD-2025-23514
Malicious code in bioql PyPI...
EUVD-2025-14597
Malicious code in bioql PyPI...
EUVD-2022-3880
Malicious code in bioql PyPI...
CVE-2025-54807
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system...
CVE-2025-54807
The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system...
PT-2025-34744
Name of the Vulnerable Software and Affected Versions: egOS WebGUI affected versions not specified Description: The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass...
CVE-2025-51606
The hippo4j asynchronous thread pooling framework (specifically hippo4j-core ) versions 1.0.0 through 1.5.0 contains a vulnerability where it uses a hard-coded secret key during the creation of JWT (JSON Web Tokens) . Attackers who gain access to the source code or compiled binary can exploit thi...
CVE-2025-44963
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...
CVE-2025-44963
RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...
