3575 matches found
CVE-2025-34501 Shuffle Master Deck Mate 2 Hard-coded Credentials & Exposed Services
Deck Mate 2 is distributed with static, hard-coded credentials for the root shell and web user interface, while multiple management services SSH, HTTP, Telnet, SMB, X11 are enabled by default. If an attacker can reach these interfaces - most often through local or near-local access such as...
CVE-2025-56801
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector IV in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that...
EUVD-2025-35161
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code...
CVE-2025-10639 Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code...
CVE-2025-10639 Usage of Hardcoded FTP Credentials EfficientLab WorkExaminer Professional
The WorkExaminer Professional server installation comes with an FTP server that is used to receive the client logs on TCP port 12304. An attacker with network access to this port can use weak hardcoded credentials to login to the FTP server and modify or read data, log files and gain remote code...
CVE-2025-56801
The Reolink Desktop Application version 8.18.12 is vulnerable to a cryptographic weakness where the AES-CFB encryption implementation uses a hardcoded Initialization Vector (IV) . Specifically, the function window.napiDecrypt.getAesIv() returns the constant string bcswebapp1234567 instead of a un...
CVE-2025-56801
The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector IV in its AES-CFB encryption implementation allowing attackers with access to the application environment to reliably decrypt encrypted configuration data. NOTE: the Supplier's position is that...
CVE-2025-60639
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
EUVD-2025-34808
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
CVE-2025-60639
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
CVE-2025-60639
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
CVE-2025-10850 Felan Framework <= 1.1.4 - Hardcoded Credentials
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fbajaxloginorregister' function and in the 'googleajaxloginorregister' function. This makes it possible for unauthenticated...
CVE-2025-10850 Felan Framework <= 1.1.4 - Hardcoded Credentials
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fbajaxloginorregister' function and in the 'googleajaxloginorregister' function. This makes it possible for unauthenticated...
CVE-2025-10850
CVE-2025-10850 pertains to the Felan Framework WordPress plugin. The vulnerability arises from hardcoded credentials in the functions fb_ajax_login_or_register and google_ajax_login_or_register, enabling unauthenticated attackers to log in as existing users who registered via Facebook or Google i...
CVE-2025-10850: Use of Hard-coded Credentials
The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4. This is due to the hardcoded password in the 'fbajaxloginorregister' function and in the 'googleajaxloginorregister' function. This makes it possible for unauthenticated...
CVE-2025-60639
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
CVE-2025-60639
Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c 2025-05-26...
CVE-2025-60639
The ATLAS-EPIC data processing application, developed by individual developer gsiegel14 , contains a security vulnerability due to the use of hard-coded credentials . This flaw was identified in commit f29312c (dated 2025-05-26). No specific exploit information or remediation steps are provided i...
CVE-2025-56749: Use of Hard-coded Credentials
Creativeitem Academy LMS up to and including 6.14 uses a hardcoded default JWT secret for token signing. This predictable secret allows attackers to forge valid JWT tokens, leading to authentication bypass and unauthorized access to any user account...