Monthly
Stored datasource passwords in data-platform-open (through commit efeacd3) can be recovered in plaintext by any authenticated, low-privileged workspace user, because the service encrypts those passwords with a hardcoded AES key that is published in the project's own source repository. An attacker who reaches the datasource detail API - for example by abusing a cross-workspace IDOR to read datasources belonging to other tenants - can pull the ciphertext and decrypt it offline without any key-cracking effort, exposing the underlying database credentials. The issue is authentication-gated rather than remote-unauthenticated, is limited to confidentiality impact, and no public exploit code has been identified at time of analysis.
Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.
Privilege escalation in FastapiAdmin through version 3.0 allows any remote attacker who can reach the API to self-register a low-privileged account and then forge an HS256 JWT that impersonates the superuser, gaining full administrative control of the application. The flaw stems from a hard-coded JWT signing secret shipped in backend/app/config/setting.py (line 67), which lets an attacker sign arbitrary tokens while retaining their own valid session_id and simply setting user_name to the superuser; token validation in backend/app/core/dependencies.py (lines 72-112) trusts these forged claims. No user interaction, administrative access, or non-default configuration is required - only the ability to reach the registration endpoint and the API, which are present by default - and no public exploit code was identified at time of analysis, though a public technical writeup of the technique exists.
Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.
Authentication bypass in ZKEACMS through 4.4 allows unauthenticated remote attackers to forge their own admin-level REST API JSON Web Tokens, because the HMAC-SHA256 key used to validate bearer tokens is hard-coded in JwtBearerDefaults.cs and is therefore identical on every installation. An attacker who signs a token with the Name claim set to 'admin' can call ApiAuthorize endpoints to modify articles and products and to read submitted form data, producing high integrity impact with limited confidentiality exposure (vendor CVSS 4.0 score 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, i.e. unauthenticated and network-reachable). Neither CISA KEV nor a packaged exploit was reported in the provided intelligence, but the signing key is published in the project's public source repository and a public write-up describes the technique, so forgery is trivial for anyone who can reach the API; the main practical limiter is whether the REST API is exposed.
Credential disclosure in netdisk-fast-download through 0.4.8 allows unauthenticated remote attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint and decrypt them using the hard-coded AES key 'nfd_auth_key2026'. This can expose cloud-drive cookies, tokens, or passwords, resulting in high confidentiality impact. Exploitation requires that the target instance has the donation feature enabled and populated with credentials; no public exploit has been identified at time of analysis.
Hard-coded cryptographic key material embedded in the /usr/bin/sysman binary of Moxa's AIG-302 Series industrial computers enables an unauthenticated attacker who already sits on the same local or logical network segment to recover the static private key and use it to decrypt or tamper with the device's protected communications. The key is identical across all affected units and is trivially extractable by reverse-engineering shipped firmware, so the confidentiality and integrity of those communications are effectively compromised once an attacker reaches the industrial LAN; availability is unaffected and no public exploit code has been identified at time of analysis, with no confirmed active exploitation. The practical barrier is the required adjacent-network position rather than any credential or user interaction, making this a moderately high priority OT/ICS exposure rather than an internet-reachable mass-exploitation issue.
Cleartext LDAP credential recovery in go-ldap-admin through 0.6.2 is possible because the application ships with a hard-coded RSA private key, committed to the public repository at config/config.go, that is used to encrypt login passwords. An attacker who obtains the encrypted password blobs - by capturing login traffic or reading a stored encrypted value - can decrypt them offline, or simply replay them to the unauthenticated /base/decryptpwd endpoint, to recover usable LDAP account credentials; no authentication, user interaction, or non-default configuration is required once ciphertext is in hand, which is the only real precondition (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N versus the vendor-provided CVSS 4.0 score of 8.2). Deployments that replaced the embedded key with their own keypair are not affected. No vendor patch is identified in the available data, and no public exploit code has been flagged at time of analysis, although a detailed public technical writeup of the decrypt oracle exists.
Firmware forgery is possible in the EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the public CDN bin.zip) because every installation ships with the same hard-coded AES key, so an attacker who recovers that key can decrypt and craft firmware packages accepted by any device that trusts the updater. Key recovery needs no credentials since the binary is publicly downloadable (PR:N), but the forged image must actually reach a device and be installed by an operator (UI:R), yielding a locally-vectored CVSS 3.1 score of 7.8 with high confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the result is a systemic, fleet-wide trust failure rather than a remotely triggerable network flaw.
Stored datasource passwords in data-platform-open (through commit efeacd3) can be recovered in plaintext by any authenticated, low-privileged workspace user, because the service encrypts those passwords with a hardcoded AES key that is published in the project's own source repository. An attacker who reaches the datasource detail API - for example by abusing a cross-workspace IDOR to read datasources belonging to other tenants - can pull the ciphertext and decrypt it offline without any key-cracking effort, exposing the underlying database credentials. The issue is authentication-gated rather than remote-unauthenticated, is limited to confidentiality impact, and no public exploit code has been identified at time of analysis.
Authentication bypass in the DataBuff ai-apm-web module through version 0.1.10 lets unauthenticated remote attackers forge administrative JWT session tokens because the application ships and consumes a hardcoded HMAC signing secret ('dev-secret') in JwtTokenService. An attacker who knows that default key can mint a token claiming the admin role with a future expiry and gain full administrative access to protected /webapi routes, most critically the Doris SQL query API, yielding high confidentiality, integrity, and availability impact (vendor score 9.3; independently assessed CVSS:3.1 base 9.8 with PR:N, no privileges or user interaction required). Exploitation is conditional on the deployment retaining the shipped default secret: any instance that has replaced it with a unique strong value is not exploitable through this path. This CVE is not listed in CISA KEV and no public exploit code was identified at time of analysis, though a third-party technical write-up describing the flaw is publicly referenced; note that classic HS256/JWT signing bypasses are trivial to script once the key is known, so the absence of a packaged exploit should not be treated as meaningful protection.
Authentication bypass in Simple Admin Core through v1.8.7 lets unauthenticated remote attackers forge a valid super-administrator JWT by signing it with the hard-coded Auth.AccessSecret (jS6VKDtsJf3z1n2VKDtsJf3z1n2) shipped in api/etc/core.yaml, then set roleId 001 to obtain full administrative control over users, roles, menus, API authorities, configuration and token issuance. Exploitation requires only network reach to the core API (default port 9100) against a deployment that still runs the vendor's default secret - no credentials and no user interaction - and the CVSS 4.0 base score is 9.3, corroborated by the independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (unauthenticated, network-exploitable, full confidentiality/integrity/availability impact). No public exploit identified at time of analysis, although a public technical writeup detailing the bypass exists, and deployments that rotated AccessSecret to a private value before deployment are not exploitable via forged signatures.
Privilege escalation in FastapiAdmin through version 3.0 allows any remote attacker who can reach the API to self-register a low-privileged account and then forge an HS256 JWT that impersonates the superuser, gaining full administrative control of the application. The flaw stems from a hard-coded JWT signing secret shipped in backend/app/config/setting.py (line 67), which lets an attacker sign arbitrary tokens while retaining their own valid session_id and simply setting user_name to the superuser; token validation in backend/app/core/dependencies.py (lines 72-112) trusts these forged claims. No user interaction, administrative access, or non-default configuration is required - only the ability to reach the registration endpoint and the API, which are present by default - and no public exploit code was identified at time of analysis, though a public technical writeup of the technique exists.
Authentication bypass in OpenBMB StaffDeck through 0.5.6 lets unauthenticated attackers forge valid administrator session tokens by signing an HMAC-SHA256 token with the hard-coded default app_secret shipped in backend/app/config.py, targeting the seeded 'admin' user in the 'tenant_demo' tenant. Successful exploitation grants full tenant administration, including access to stored model and channel credentials; the assessed CVSS 3.1 score is 9.2 (Critical) with AV:N/PR:N/UI:N but AC:H/AT:P, because only deployments that have not rotated the default secret and that still retain the demo tenant and admin account are affected. No public exploit identified at time of analysis, and no CISA KEV entry or vendor-patched version was provided in the source data.
Authentication bypass in ZKEACMS through 4.4 allows unauthenticated remote attackers to forge their own admin-level REST API JSON Web Tokens, because the HMAC-SHA256 key used to validate bearer tokens is hard-coded in JwtBearerDefaults.cs and is therefore identical on every installation. An attacker who signs a token with the Name claim set to 'admin' can call ApiAuthorize endpoints to modify articles and products and to read submitted form data, producing high integrity impact with limited confidentiality exposure (vendor CVSS 4.0 score 8.8; independently assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, i.e. unauthenticated and network-reachable). Neither CISA KEV nor a packaged exploit was reported in the provided intelligence, but the signing key is published in the project's public source repository and a public write-up describes the technique, so forgery is trivial for anyone who can reach the API; the main practical limiter is whether the REST API is exposed.
Credential disclosure in netdisk-fast-download through 0.4.8 allows unauthenticated remote attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint and decrypt them using the hard-coded AES key 'nfd_auth_key2026'. This can expose cloud-drive cookies, tokens, or passwords, resulting in high confidentiality impact. Exploitation requires that the target instance has the donation feature enabled and populated with credentials; no public exploit has been identified at time of analysis.
Hard-coded cryptographic key material embedded in the /usr/bin/sysman binary of Moxa's AIG-302 Series industrial computers enables an unauthenticated attacker who already sits on the same local or logical network segment to recover the static private key and use it to decrypt or tamper with the device's protected communications. The key is identical across all affected units and is trivially extractable by reverse-engineering shipped firmware, so the confidentiality and integrity of those communications are effectively compromised once an attacker reaches the industrial LAN; availability is unaffected and no public exploit code has been identified at time of analysis, with no confirmed active exploitation. The practical barrier is the required adjacent-network position rather than any credential or user interaction, making this a moderately high priority OT/ICS exposure rather than an internet-reachable mass-exploitation issue.
Cleartext LDAP credential recovery in go-ldap-admin through 0.6.2 is possible because the application ships with a hard-coded RSA private key, committed to the public repository at config/config.go, that is used to encrypt login passwords. An attacker who obtains the encrypted password blobs - by capturing login traffic or reading a stored encrypted value - can decrypt them offline, or simply replay them to the unauthenticated /base/decryptpwd endpoint, to recover usable LDAP account credentials; no authentication, user interaction, or non-default configuration is required once ciphertext is in hand, which is the only real precondition (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N versus the vendor-provided CVSS 4.0 score of 8.2). Deployments that replaced the embedded key with their own keypair are not affected. No vendor patch is identified in the available data, and no public exploit code has been flagged at time of analysis, although a detailed public technical writeup of the decrypt oracle exists.
Firmware forgery is possible in the EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the public CDN bin.zip) because every installation ships with the same hard-coded AES key, so an attacker who recovers that key can decrypt and craft firmware packages accepted by any device that trusts the updater. Key recovery needs no credentials since the binary is publicly downloadable (PR:N), but the forged image must actually reach a device and be installed by an operator (UI:R), yielding a locally-vectored CVSS 3.1 score of 7.8 with high confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the result is a systemic, fleet-wide trust failure rather than a remotely triggerable network flaw.