StaCoAn

StaCoAn Not maintained anymore! Will be archived soon. StaCoAn is a crossplatform tool which aids developers, bugbounty hunters and ethical hackers performing static code analysis on mobile applications. This tool will look for interesting lines in the code which can contain: Hardcoded credential...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

CVE-2024-28987

CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credentials Exploit ⚠️ DISCLAIMER: This tool is for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. 📋...

juniper-cve-2015-7755

Juniper CVE-2015-7755 & CVE-2015-7756 This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS. For more information about these issues, please see the URLs below:...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

HPE-Aruba-AOS8-Vulnerabilities

⚠️ Disclosure Status: All findings in this repository were submitted to the HPE Networking Bug Bounty Program Bugcrowd between May–June 2026. Five of six submissions were closed as "Not Applicable" at triage level without technical reconciliation of the submitted evidence. No fixes have been issue...

LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

Four-Faith F3x36 - Authentication Bypass

Four-Faith F3x36 router with firmware v2.0.0 contains an authentication bypass caused by hard-coded credentials in the administrative web server, letting attackers with knowledge of credentials gain administrative access via crafted HTTP requests. id: CVE-2024-9643 info: name: Four-Faith F3x36 -...

Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials

Sitecore Experience Manager XM and Experience Platform XP versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

NetMRI < 7.6.1 - Authentication Bypass via Hardcoded Credentials

An issue was discovered in Infoblox NETMRI before 7.6.1. Authentication Bypass via a Hardcoded credential can occur. id: CVE-2025-32815 info: name: NetMRI 7.6.1 - Authentication Bypass via Hardcoded Credentials author: iamnoooob,pdresearch severity: medium description: | An issue was discovered i...

FUXA <= 1.2.7 - Hardcoded JWT Secret Authentication Bypass

FUXA v1.2.7 contains a hardcoded credentials vulnerability caused by use of a hard-coded secret key in server/api/jwt-helper.js, letting remote attackers forge admin tokens and bypass authentication, exploit requires no special conditions. id: CVE-2025-69971 info: name: FUXA = 1.2.7 - Hardcoded J...

CVE-2026-77933

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access...

CVE-2026-77933 DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access...

CVE-2026-77933

DB-GPT through version 0.8.2 is vulnerable to a hardcoded credentials flaw within its default docker-compose.yml file. The configuration sets a static MYSQL_ROOT_PASSWORD and exposes port 3306 on all network interfaces. An attacker who can reach port 3306 or the shared dbgptnet network can authen...

EUVD-2026-104689

DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQLROOTPASSWORD and publishes port 3306 on all interfaces. Attackers reaching port 3306 or the shared dbgptnet network can authenticate as root@% to gain full database access...

CVE-2026-13714

Realtyna WPL 5.3.0 - Unauthenticated RCE Exploit Description This exploit targets a critical vulnerability in Realtyna Organic IDX + WPL Real Estate plugin versions prior to 5.3.0. The plugin uses hardcoded credentials and allows unauthenticated file upload leading to Remote Code Execution RCE...

frida

frida This repository contains various Frida scripts for Android application penetration testing. I created this project to demonstrate the capabilities of the Frida dynamic-analysis framework. You can read my "Introduction to Frida" blog post on Medium, where I'm explaining how to use Frida with...

CVE-2015-7755-POC

CVE-2015-7755-POC CVE-2015-7755 vulnerability detection using ssh to connect those vulnerable version: ScreenOS 6.2.0r15—6.2.0r18，6.3.0r12—6.3.0r20 Juniper Networks user: root passwd: %sun='%s' = %u...