Exfiltrates user cookies to hardcoded server endpoint during normal operations

Published in 2020, the autodzee package is a Python librarythat bypasses Deezer API restrictions to download music.The package was found to exfiltrate user data to a hardcoded server,which could be used for malicious purposes...

When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.

Published in 2019, the autodzee package is a Python librarythat bypasses Deezer API restrictions to download music.The package was found to exfiltrate user data to a hardcoded server,which could be used for malicious purposes...

CVE-2024-57040

TP-Link TL-WR845N devices with firmware TL-WR845NUNV4200909 and TL-WR845NUNV4190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

CVE-2024-57040: Use of Hard-coded Credentials

TP-Link TL-WR845N devices with firmware TL-WR845NUNV4200909 and TL-WR845NUNV4190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has...

CVE-2024-50688

The SunGrow iSolarCloud Android application (versions V2.1.6.20241017 and prior) contains hardcoded credentials . The application and the associated cloud service utilize the same MQTT credentials for exchanging device telemetry, regardless of the specific user account. This vulnerability allows ...

CVE-2024-57040

The TP-Link TL-WR845N wireless router is affected by a vulnerability involving a hardcoded password for the root account . This flaw exists because a default, unchanging password is embedded within the router's software, which can be extracted by analyzing the downloaded firmware or recovered via...

PT-2025-8752

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR845N versions TL-WR845NUN V4 200909 through TL-WR845NUN V4 190219 Description A hardcoded password for the root account was discovered, which can be obtained via a brute force attack. Recommendations For versions TL-WR845NUN V4...

PT-2025-8757 · Pypi · Colabrun

Name of the Vulnerable Software and Affected Versions: colabrun affected versions not specified Description: The colabrun package is a Python library that exfiltrates user cookies to a hardcoded IP address. It was found to exfiltrate user data to a hardcoded server, which could be used for...

CVE-2024-50688

SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application regardless of the user account and the cloud uses the same MQTT credentials for exchanging the device telemetry...

PT-2025-8756 · Autodzee · Autodzee

Name of the Vulnerable Software and Affected Versions: autodzee affected versions not specified Description: The autodzee package, a Python library that bypasses Deezer API restrictions to download music, was found to exfiltrate user data to a hardcoded server. This could potentially be used for...

PT-2025-8755 · Automslc · Automslc

Name of the Vulnerable Software and Affected Versions: automslc affected versions not specified Description: The automslc package, a Python library that bypasses Deezer API restrictions to download music, was found to exfiltrate user data to a hardcoded server. This could potentially be used for...

CVE-2024-57040

TP-Link TL-WR845N devices with firmware TL-WR845NUNV4200909 and TL-WR845NUNV4190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has...

PT-2025-8744

Name of the Vulnerable Software and Affected Versions SunGrow iSolarCloud Android application versions V2.1.6.20241017 and prior Description The issue concerns hardcoded credentials in the SunGrow iSolarCloud Android application. Specifically, the application and the cloud use the same MQTT...

MAL-2025-191909 Malicious code in transaction-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1efc9cf33a18e7f3c4294c39aabadf136974e4e2ee56c874ba337ac609c6b77 The only thing the package does is send out all the given data about a cryptocurrency transaction, including the private key, to a hardcoded webhook. Feedback...

Malicious code in transaction-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1efc9cf33a18e7f3c4294c39aabadf136974e4e2ee56c874ba337ac609c6b77 The only thing the package does is send out all the given data about a cryptocurrency transaction, including the private key, to a hardcoded webhook. Feedback...

PT-2025-62998

Уязвимость SCADA-системы MasterSCADA 4D связана с использованием жестко закодированного криптографического ключа. Эксплуатация уязвимости может позволить нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации...

PT-2025-23093

Уязвимость системы автоматизации IT-процессов SimpleOne ITSM связана с возможностью использования жестко закодированных учетных данных. Эксплуатация уязвимости, может позволить нарушителю, действующему удаленно, осуществить компрометацию почтового домена...

CVE-2024-57790

IXON B.V. IXrouter IX2400 Industrial Edge Gateway v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vulnerability allows physically proximate attackers to gain root access via UART or SSH...

CVE-2024-57790

IXON B.V. IXrouter IX2400 Industrial Edge Gateway v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flash memory. This vulnerability allows physically proximate attackers to gain root access via UART or SSH...