Sitecore XP CVE-2025-34511 Post-Authentication File Upload

This module exploits CVE-2025-34511, a file upload vulnerability in PowerShell extensions. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold. Module Options msf use exploit/windows/http/sitecore/xpcve202534511 msf undefinedxpcve202534511 sho...

Sitecore XP CVE-2025-34510 Post-Authentication Remote Code Execution

This module exploits CVE-2025-34510, path traversal leading to remote code execution. The module exploits also CVE-2025-34509 - hardcoded credentials of ServicesAPI account - to gain foothold. Module Options msf use exploit/windows/http/sitecore/xpcve202534510 msf undefinedxpcve202534510 show...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

PT-2025-25490 · Apache · Apache Nuttx Rtos

Name of the Vulnerable Software and Affected Versions: Apache NuttX RTOS versions 6.22 through 12.9.0 Description: An issue was discovered in the Apache NuttX RTOS apps/examples/xmlrpc application, where a device stats structure stored remotely provided parameters with a hardcoded buffer size,...

PYSEC-2025-258

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

PYSEC-2025-258

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388: Use of Hard-coded Credentials

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

Versions of OpenC3 COSMOS prior to v6.0.2 are vulnerable to the use of hard-coded credentials for the Service Account. An attacker could leverage these leaked credentials to use the Service Account as a backdoor to the system. Remediation is available by upgrading the openc3 package to version 6....

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

PT-2025-25416

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS version 6.0.0 Description The issue is related to hardcoded credentials for the Service Account. Recommendations For OpenC3 COSMOS version 6.0.0, consider changing the hardcoded credentials for the Service Account to unique, secu...

CVE-2025-22463

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password...

CVE-2025-22455

A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials...

PT-2025-26164 · D Link · D-Link Dph-400S/Se Voip Phone

Name of the Vulnerable Software and Affected Versions: D-Link DPH-400S/SE VoIP Phone version 1.01 Description: The issue concerns hardcoded provisioning variables, including PROVIS USER PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extrac...

CVE-2025-5353

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials...

CVE-2025-5353

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials...

CVE-2025-5353

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials...

CVE-2025-22463

A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password...