Use of Hard-coded Credentials

Records the NVD classes as Use of Hard-coded Credentials (CWE-798), highest CVSS first.

1. CRITICAL 9.6CVE-2026-66890public PoC2026-09-15

   The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.

   AI risk analysis on Exploit-DB.ai →

2. CRITICAL 9.1CVE-2026-71238public PoC2026-08-05

   DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the …

   AI risk analysis on Exploit-DB.ai →

3. HIGH 8.8CVE-2026-68950public PoC2026-09-15

   The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable.

   AI risk analysis on Exploit-DB.ai →