CWE-260 · Authentication
Password in Configuration File
24CVEs
SortMost likely exploited
24 CVEs with CWE-260 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2017-7925CheckDahua Security - Configuration File DisclosureDahuasecurity · Dahua Technology Co., Ltd Digital Video Recorders and IP Cameras · 2017-05-06 | – | 51% | 2017-05-06 |
| CVE-2017-7923A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.…Hikvision · Hikvision Cameras · 2017-05-06 | – | 2.3% | 2017-05-06 |
| CVE-2016-7043It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same serv…KIE · kie-server · CVSS 5.9 · 2019-05-15 | 5.9 | 1.5% | 2019-05-15 |
| CVE-2019-3780Cloud Foundry Container Runtime Leaks IAAS CredentialsCloud Foundry · Cloud Foundry Container Runtime (CFCR) · CVSS 9.1 · 2019-03-08 | 9.1 | 1.4% | 2019-03-08 |
| CVE-2023-34128Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and e…SonicWall · GMS · 2023-07-13 | – | 0.7% | 2023-07-13 |
| CVE-2023-53770MiniDVBLinux 5.4 Unauthenticated Configuration Download via Backup EndpointMiniDVBLinux · MiniDVBLinux(TM) Distribution (MLD) · CVSS 8.7 · 2025-12-09 | 8.7 | 0.6% | 2025-12-09 |
| CVE-2019-25465Hisilicon HiIpcam V100R003 Information Disclosure via Directory TraversalHisilicon · HiIpcam · CVSS 7.5 · 2026-03-11 | 7.5 | 0.6% | 2026-03-11 |
| CVE-2023-53739Tinycontrol LAN Controller v3 LK3 1.58a Unauthenticated Configuration Backup DisclosureTinycontrol · Tinycontrol LAN Controller v · CVSS 9.9 · 2025-12-09 | 9.9 | 0.5% | 2025-12-09 |
| CVE-2025-33093IBM Sterling Partner Engagement Manager information disclosureIBM · Sterling Partner Engagement Manager · CVSS 7.5 · 2025-05-07 | 7.5 | 0.4% | 2025-05-07 |
| CVE-2025-32111The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-credentials: false" for actions/checkout.acme.sh project · acme.sh · CVSS 8.7 · 2025-04-04 | 8.7 | 0.4% | 2025-04-04 |
| CVE-2021-35033A vulnerability in specific versions of Zyxel NBG6818, NBG7815, WSQ20, WSQ50, WSQ60, and WSR30 firmware with pre-configured password management could allow an attacker to obtain r…Zyxel · NBG6818 series firmware · CVSS 7.8 · 2021-11-23 | 7.8 | 0.4% | 2021-11-23 |
| CVE-2025-57754eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)kristoferfannar · eslint-ban-moment · CVSS 9.8 · 2025-08-21 | 9.8 | 0.4% | 2025-08-21 |
| CVE-2020-5721MikroTik WinBox 3.22 and below stores the user's cleartext password in the settings.cfg.viw configuration file when the Keep Password field is set and no Master Password is set. K…Mikrotik · MikroTik WinBox · 2020-04-15 | – | 0.4% | 2020-04-15 |
| CVE-2014-5400Hospira MedNet Password in Configuration FileHospira · MedNet · CVSS 6.8 · 2015-04-03 | 6.8 | 0.3% | 2015-04-03 |
| CVE-2025-15151TaleLin Lin-CMS Tests Folder config.py password in configuration fileTaleLin · Lin-CMS · CVSS 3.7 · 2025-12-28 | 3.7 | 0.3% | 2025-12-28 |
| CVE-2025-25022IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosureIBM · QRadar Suite Software · CVSS 9.6 · 2025-06-03 | 9.6 | 0.3% | 2025-06-03 |
| CVE-2023-2790TOTOLINK N200RE Telnet Service custom.conf password in configuration fileTOTOLINK · N200RE · CVSS 2.3 · 2023-05-18 | 2.3 | 0.3% | 2023-05-18 |
| CVE-2025-51540EzGED3 3.5.0 stores user passwords using an insecure hashing scheme: md5(md5(password)). This hashing method is cryptographically weak and allows attackers to perform efficient of…No vendor recorded · CVSS 5.3 · 2025-08-19 | 5.3 | 0.3% | 2025-08-19 |
| CVE-2025-33119IBM QRadar SIEM Information DisclosureIBM · QRadar Security Information and Event Management · CVSS 6.5 · 2025-11-12 | 6.5 | 0.3% | 2025-11-12 |
| CVE-2024-49817IBM Security Guardium Key Lifecycle Manager information disclosureIBM · Security Guardium Key Lifecycle Manager · CVSS 4.4 · 2024-12-17 | 4.4 | 0.2% | 2024-12-17 |
| CVE-2025-6513BRAIN2 Configuration file for database access not sufficiently securedBizerba SE & Co. KG · BRAIN2 · CVSS 9.3 · 2025-06-23 | 9.3 | 0.2% | 2025-06-23 |
| CVE-2025-36002IBM Sterling B2B Integrator information disclosureIBM · Sterling B2B Integrator · CVSS 5.5 · 2025-10-16 | 5.5 | 0.2% | 2025-10-16 |
| CVE-2024-45673IBM Security Verify Bridge information disclosureIBM · Security Verify Bridge Directory Sync · CVSS 5.5 · 2025-02-21 | 5.5 | 0.1% | 2025-02-21 |
| CVE-2025-36100IBM MQ information disclosureIBM · MQ · CVSS 5.1 · 2025-09-07 | 5.1 | 0.1% | 2025-09-07 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.