CWE-260: Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
23 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2025-57754 — eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
- CVE-2025-25022 — IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure
- CVE-2025-6513 — BRAIN2 Configuration file for database access not sufficiently secured
- CVE-2025-32111 — The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-cred
- CVE-2025-33093 — IBM Sterling Partner Engagement Manager information disclosure
- CVE-2019-25465 — Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
- CVE-2025-33119 — IBM QRadar SIEM Information Disclosure
- CVE-2025-15151 — TaleLin Lin-CMS Tests Folder config.py password in configuration file
- CVE-2025-36002 — IBM Sterling B2B Integrator information disclosure
- CVE-2025-36100 — IBM MQ information disclosure
- CVE-2024-49817 — IBM Security Guardium Key Lifecycle Manager information disclosure
Recently published
- CVE-2019-25465 — Hisilicon HiIpcam V100R003 Information Disclosure via Directory Traversal
- CVE-2025-15151 — TaleLin Lin-CMS Tests Folder config.py password in configuration file
- CVE-2025-33119 — IBM QRadar SIEM Information Disclosure
- CVE-2025-36002 — IBM Sterling B2B Integrator information disclosure
- CVE-2025-36100 — IBM MQ information disclosure
- CVE-2025-57754 — eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)
- CVE-2025-6513 — BRAIN2 Configuration file for database access not sufficiently secured
- CVE-2025-25022 — IBM QRadar Suite Software and IBM Cloud Pak for Security information disclosure
- CVE-2025-33093 — IBM Sterling Partner Engagement Manager information disclosure
- CVE-2025-32111 — The Docker image from acme.sh before 40b6db6 is based on a .github/workflows/dockerhub.yml file that lacks "persist-cred
- CVE-2024-49817 — IBM Security Guardium Key Lifecycle Manager information disclosure