CWE-798: Use of Hard-coded Credentials — known CVE vulnerabilities

CVEs classified under CWE-798 (Use of Hard-coded Credentials), ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (50)

• CVE-2026-18452 — CVSS 10.0 (critical): DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit…
• CVE-2026-45336 — CVSS 10.0 (critical): HireFlow is a web-based interview management system for managing candidates, scheduling interviews, and tracking hiring progress. In 1.2…
• CVE-2026-13768 — CVSS 10.0 (critical): Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager…
• CVE-2026-45631 — CVSS 10.0 (critical): Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.27.0 to before 0.29.3, a hardcoded BETTER_AUTH_SECRET fallback…
• CVE-2026-22769 — CVSS 10.0 (critical) — actively exploited: Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered…
• CVE-2025-42890 — CVSS 10.0 (critical): SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing…
• CVE-2025-7503: An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented…
• CVE-2025-20309 — CVSS 10.0 (critical): A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition…
• CVE-2025-48748 — CVSS 10.0 (critical): Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.
• CVE-2025-20188 — CVSS 10.0 (critical): A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles…
• CVE-2024-41794 — CVSS 10.0 (critical): A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager (All versions). Affected devices contain hardcoded credentials for…
• CVE-2024-51551 — CVSS 10.0 (critical): Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials. Affected…
• CVE-2024-42450 — CVSS 10.0 (critical): The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function…
• CVE-2023-2306 — CVSS 10.0 (critical): Qognify NiceVision versions 3.1 and prior are vulnerable to exposing sensitive information using hard-coded credentials. With these…
• CVE-2023-24022 — CVSS 10.0 (critical): Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB devices with firmware through RTS/RTD 3.7.11.3 have hardcoded credentials that are…
• CVE-2022-45444 — CVSS 10.0 (critical): Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select…
• CVE-2021-40422 — CVSS 10.0 (critical): An authentication bypass vulnerability exists in the device password generation functionality of Swift Sensors Gateway SG3-1010. A…
• CVE-2021-40519 — CVSS 10.0 (critical): Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.
• CVE-2021-0248 — CVSS 10.0 (critical): This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS…
• CVE-2020-6779 — CVSS 10.0 (critical): Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an…
• CVE-2020-1614 — CVSS 10.0 (critical): A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which…
• CVE-2013-3542 — CVSS 10.0 (critical): Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly…
• CVE-2018-5560 — CVSS 10.0 (critical): A reliance on a static, hard-coded credential in the design of the cloud-based storage system of Practecol's Guardzilla All-In-One Video…
• CVE-2019-0022 — CVSS 10.0 (critical): Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any…
• CVE-2019-0020 — CVSS 10.0 (critical): Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any…
• CVE-2018-0222 — CVSS 10.0 (critical): A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote attacker to log in to an affected…
• CVE-2016-9335 — CVSS 10.0 (critical): A hard-coded cryptographic key vulnerability was identified in Red Lion Controls Sixnet-Managed Industrial Switches running firmware…
• CVE-2017-2343 — CVSS 10.0 (critical): The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide…
• CVE-2014-9198 — CVSS 10.0 (critical): The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which…
• CVE-2012-6428 — CVSS 10.0 (critical): The Carlo Gavazzi EOS-Box stores hard-coded passwords in the PHP file of the device. By using the hard-coded passwords, attackers can log…
• CVE-2007-1063 — CVSS 10.0 (critical): The SSH server in Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G, and 7971G, with firmware 8.0(4)SR1 and earlier, uses a…
• CVE-2025-6950: An Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs…
• CVE-2023-39420 — CVSS 9.9 (critical): The RDPCore.dll component as used in the IRM Next Generation booking engine, allows a remote user to connect to customers with an "admin"…
• CVE-2019-11898 — CVSS 9.9 (critical): Unauthorized APE administration privileges can be achieved by reverse engineering one of the APE service tools. The service tool is…
• CVE-2021-43717 — CVSS 9.8 (critical): An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can…
• CVE-2026-74891 — CVSS 9.8 (critical): openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the…
• CVE-2026-67614 — CVSS 9.8 (critical): CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated…
• CVE-2026-73519 — CVSS 9.8 (critical): WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in…
• CVE-2026-69102 — CVSS 9.8 (critical): MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows…
• CVE-2025-63823 — CVSS 9.8 (critical): My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass…
• CVE-2026-55579 — CVSS 9.8 (critical): Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a…
• CVE-2026-65879 — CVSS 9.8 (critical): Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A…
• CVE-2026-8983 — CVSS 9.8 (critical): Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for…
• CVE-2026-13446 — CVSS 9.8 (critical): IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own…
• CVE-2026-49352 — CVSS 9.8 (critical): 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-chang…
• CVE-2026-14807 — CVSS 9.8 (critical): ERP App developed by PROG MIS has a Use of Hard-coded Credentials vulnerability, allowing unauthenticated remote attackers to log in to…
• CVE-2026-56265 — CVSS 9.8 (critical): Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server…
• CVE-2026-47846 — CVSS 9.8 (critical): Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrator account is…
• CVE-2026-10557 — CVSS 9.8 (critical): The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These…
• CVE-2026-11849 — CVSS 9.8 (critical): The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote…