Lucene search
+L

7862 matches found

NVD
NVD
added 3 hours ago4 views

CVE-2026-48031

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS0.00055EPSS
SaveExploits0References3
CVE
CVE
added 4 hours ago38 views

CVE-2026-48031

Technical details about CVE-2026-48031 are not publicly provided in the supplied documents. The go-base JWT-secret issue is described at a high level; monitor for updates for concrete affected versions, root cause, and fixes.

9.1CVSS7.7AI score0.00055EPSS
SaveExploits0References3
Cvelist
Cvelist
added 4 hours ago9 views

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS0.00055EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 4 hours ago2 views

CVE-2026-48031 Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery

go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public repository forge tokens for arbitrary users, including admin...

9.1CVSS7.7AI score0.00055EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 5 hours ago2 views

CVE-2025-15628 Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

8.2CVSS5.5AI score
SaveExploits0References3
Cvelist
Cvelist
added 5 hours ago6 views

CVE-2025-15628 Hardcoded Certificates in TP-Link Omada Device Communications

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed devices. An attacker who obtains the embedded certificates may be able to impersonate trusted controllers or devices and intercept affected communications...

8.2CVSS
SaveExploits0References3
CVE
CVE
added 5 hours ago7 views

CVE-2025-15628

The CVE affects TP-Link Omada devices using embedded certificates shared across deployments. The root cause is hardcoded/embedded certificates enabling impersonation of trusted controllers or devices, allowing interception of communications. The connected documents confirm the same description an...

8.2CVSS5.5AI score
SaveExploits0References3
CVE
CVE
added 5 hours ago6 views

CVE-2025-15627

The CVE-2025-15627 issue involves hard-coded cryptographic keys in the Omada adoption protocol used by TP-Link/Omada controllers and managed devices. The underlying flaw enables impersonation of trusted controllers or devices and could expose sensitive adoption-related communications during devic...

6.9CVSS5.5AI score
SaveExploits0References3
Cvelist
Cvelist
added 5 hours ago10 views

CVE-2025-15627 Hardcoded Cryptographic Keys in TP-Link Omada Adoption Protocol Authentication

A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and protect authentication exchanges between controllers and managed devices during device adoption. An attacker may be able to impersonate trusted controllers o...

6.9CVSS
SaveExploits0References3
EUVD
EUVD
added 8 hours ago5 views

EUVD-2026-52339

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

9.8CVSS5.8AI score
SaveExploits0References2
Nuclei
Nuclei
added 19 hours ago17 views

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

9.8CVSS5.5AI score0.02036EPSS
SaveExploits0References3
Nuclei
Nuclei
added 19 hours ago28 views

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

9.8CVSS7.7AI score0.0293EPSS
SaveExploits0References2
Nuclei
Nuclei
added 19 hours ago110 views

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

9.8CVSS5.3AI score0.33606EPSS
SaveExploits1References4
Nuclei
Nuclei
added 19 hours ago44 views

NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials

An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. id: CVE-2025-32815 info: name: NetMRI 7.6.1 - Authentication Bypass via Hardcoded Credentials author: iamnoooob,pdresearch severity: medium description: | An issue was discovered i...

6.5CVSS6.5AI score0.39695EPSS
SaveExploits0References2
Nuclei
Nuclei
added 19 hours ago61 views

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.8CVSS7.8AI score0.03119EPSS
SaveExploits1References4
Nuclei
Nuclei
added 19 hours ago59 views

Sony IPELA Engine IP Camera - Hardcoded Account

Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials. id: CVE-2016-7834 info: name: Sony IPELA Engine IP Camera - Hardcoded Account author: af001 severity: high description: | Multiple SONY network cameras are vulnerable to sensitive informati...

8.8CVSS7.6AI score0.03869EPSS
SaveExploits0References5
Nuclei
Nuclei
added 19 hours ago57 views

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

9.8CVSS8.7AI score0.77803EPSS
SaveExploits5References2
Nuclei
Nuclei
added 19 hours ago125 views

Viessmann Vitogate 300 - Hardcoded Password

A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface. id: CVE-2023-5222 info: name: Viessmann Vitogate 300 - Hardcoded Password author: ritikchaddha severity: critical description: | A critica...

9.8CVSS6.8AI score0.74525EPSS
SaveExploits4References3
Nuclei
Nuclei
added 19 hours ago68 views

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

7.5CVSS6.8AI score0.03722EPSS
SaveExploits0References5
Nuclei
Nuclei
added 20 hours ago102 views

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

7.5CVSS8.1AI score0.53893EPSS
SaveExploits6References3
Rows per page
Query Builder