NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no...

CVE-2025-4130

CVE-2025-4130 affects PAVO Pay prior to 13.05.2025. The issue is a hard-coded credentials flaw that enables reading of sensitive constants within an executable. Affected product: PAVO Pay (mobile payment management), with exposure described as reading sensitive constants due to embedded credentia...

CVE-2025-4130 Hardcoded Credentials in PAVO Inc.'s PAVO Pay

Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025...

CVE-2025-4130 Hardcoded Credentials in PAVO Inc.'s PAVO Pay

Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025...

PT-2025-30359 · Unknown · Haxcms-Nodejs

Name of the Vulnerable Software and Affected Versions: HAX CMS NodeJS versions 11.0.9 and below Description: HAX CMS NodeJS is distributed with hardcoded default credentials for user and superuser accounts and default private keys for JWTs. Users are not prompted to change these credentials or...

CVE-2025-6982 Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5

Use of Hard-coded Credentials in TP-Link Archer C50 V3 = 180703/V4 = 250117 /V5 = 200407 , and C20 V5 USV5260419 or EUV5260317 allows attackers to decrypt the config.xml files...

CVE-2025-53758: Cleartext Storage of Sensitive Information

This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management interface. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the hardcoded default...

CVE-2025-52363: Use of Hard-coded Credentials

Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access...

CVE-2024-38648: Use of Hard-coded Credentials

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials...

CVE-2025-5023

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Corporation photovoltaic system monitor “EcoGuideTAB” PV-DR004J all versions and PV-DR004JA all versions allows an attacker within the Wi-Fi communication range between the units of the product measurement unit and display unit to...

CVE-2025-37103 Hardcoded Credential Exposure Allows Unauthorized Access in Web Interface

Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system...

CVE-2025-37103 Hardcoded Credential Exposure Allows Unauthorized Access in Web Interface

Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication. Successful exploitation could allow a remote attacker to gain administrative access to the system...

CVE-2025-45813

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

CVE-2025-45813

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

CVE-2025-45813

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

CVE-2025-45813: Use of Hard-coded Credentials

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

CVE-2025-45813

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

PT-2025-27659

Name of the Vulnerable Software and Affected Versions Cisco Unified Communications Manager Unified CM versions 15.0.1.13010-1 through 15.0.1.13017-1 Cisco Unified Communications Manager Session Management Edition Unified CM SME versions 15.0.1.13010-1 through 15.0.1.13017-1 Description A...

CVE-2025-45813

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials...

CVE-2025-45813

The ENENSYS IPGuard v2 device (version 2.10.0 ), used for securing IP streaming transmissions, contains hardcoded credentials (CWE-798). This vulnerability allows a remote attacker to potentially disclose protected information . While the vulnerability is associated with strictly encrypted accoun...