Common Weakness Enumeration
CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
432 vulnerabilities reference this CWE, most recent first.
GHSA-5V73-8V9G-J67X
Vulnerability from github – Published: 2026-07-28 15:32 – Updated: 2026-07-28 15:32
VLAI
Details
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Only version 6.7 was tested but all versions should be considered as vulnerable.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-41874"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-28T13:18:23Z",
"severity": "MODERATE"
},
"details": "Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.\n\n\nThe vendor assessed the likelihood of exploitation as very low and determined that a fix is\u00a0not necessary.\n\n\n\nOnly version 6.7 was tested but all versions should be considered as vulnerable.",
"id": "GHSA-5v73-8v9g-j67x",
"modified": "2026-07-28T15:32:17Z",
"published": "2026-07-28T15:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41874"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/07/CVE-2026-41874"
},
{
"type": "WEB",
"url": "https://opensolution.org/shopping-cart-quick-cart.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-5V78-8GV6-C945
Vulnerability from github – Published: 2024-04-15 12:30 – Updated: 2024-07-08 15:31
VLAI
Details
Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product's login page may obtain configured credentials.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-23486"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-15T11:15:07Z",
"severity": "CRITICAL"
},
"details": "Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthenticated attacker with access to the product\u0027s login page may obtain configured credentials.",
"id": "GHSA-5v78-8gv6-c945",
"modified": "2024-07-08T15:31:54Z",
"published": "2024-04-15T12:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23486"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN58236836"
},
{
"type": "WEB",
"url": "https://www.buffalo.jp/news/detail/20240410-01.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WRQ-XQGM-W7QW
Vulnerability from github – Published: 2026-10-15 09:30 – Updated: 2026-10-15 09:30
VLAI
Details
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.
This issue was fixed in IPx series version 6.62.0100.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-63315"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-15T09:17:17Z",
"severity": "HIGH"
},
"details": "WebCTI service for Slican IPx telephone exchanges\u00a0stores\u00a0temporary subscriber password in plaintext. An attacker with\u00a0access to the database can obtain the user\u0027s password and log in to the subscriber\u0027s account.\n\n\n\nThis issue was fixed in IPx series version 6.62.0100.",
"id": "GHSA-5wrq-xqgm-w7qw",
"modified": "2026-10-15T09:30:35Z",
"published": "2026-10-15T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63315"
},
{
"type": "WEB",
"url": "https://cert.pl/posts/2026/08/CVE-2026-63314"
},
{
"type": "WEB",
"url": "https://www.slican.pl/oferta/oprogramowanie/aplikacje-cti/webcti-dla-abonenta"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-63CG-FQR3-853J
Vulnerability from github – Published: 2026-07-07 12:31 – Updated: 2026-07-08 21:30
VLAI
Details
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.
Active Directory accounts are not affected by this vulnerability.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-14867"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-07T10:16:40Z",
"severity": "MODERATE"
},
"details": "Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all\u00a0versions prior to 17.0.0. A local attacker could retrieve users\u2019 credentials.\u00a0\n\nActive Directory accounts are not affected by this vulnerability.",
"id": "GHSA-63cg-fqr3-853j",
"modified": "2026-07-08T21:30:25Z",
"published": "2026-07-07T12:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14867"
},
{
"type": "WEB",
"url": "https://www.pcvue.com/security/#SB2026-5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:Amber",
"type": "CVSS_V4"
}
]
}
GHSA-64JR-GGW8-H9JC
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2023-01-14 05:28
VLAI
Summary
Credentials stored in plain text by debian-package-builder Plugin
Details
debian-package-builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml on the Jenkins controller. This credential can be viewed by users with access to the Jenkins controller file system.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "ru.yandex.jenkins.plugins.debuilder:debian-package-builder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.6.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2125"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-14T05:28:50Z",
"nvd_published_at": "2020-02-12T15:15:00Z",
"severity": "LOW"
},
"details": "debian-package-builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file `ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml` on the Jenkins controller. This credential can be viewed by users with access to the Jenkins controller file system.",
"id": "GHSA-64jr-ggw8-h9jc",
"modified": "2023-01-14T05:28:50Z",
"published": "2022-05-24T17:08:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2125"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/debian-package-builder-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1558"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/02/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Credentials stored in plain text by debian-package-builder Plugin"
}
GHSA-656G-HF8V-X2RW
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-12-29 00:33
VLAI
Summary
Secret stored in plain text by Jenkins Slack Upload Plugin
Details
Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:slack-uploader"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2208"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-29T00:33:11Z",
"nvd_published_at": "2020-07-02T15:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job `config.xml` files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.",
"id": "GHSA-656g-hf8v-x2rw",
"modified": "2022-12-29T00:33:11Z",
"published": "2022-05-24T17:22:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2208"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/slack-uploader-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1627"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/07/02/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Secret stored in plain text by Jenkins Slack Upload Plugin"
}
GHSA-6793-GMP9-2535
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2023-01-05 21:39
VLAI
Summary
Password stored in plain text by ECX Copy Data Management Plugin
Details
Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.catalogic.ecxjenkins:catalogic-ecx"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2128"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-05T21:39:10Z",
"nvd_published_at": "2020-02-12T15:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.",
"id": "GHSA-6793-gmp9-2535",
"modified": "2023-01-05T21:39:10Z",
"published": "2022-05-24T17:08:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2128"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/catalogic-ecx-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1549"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/02/12/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Password stored in plain text by ECX Copy Data Management Plugin"
}
GHSA-683F-HCW3-5VGR
Vulnerability from github – Published: 2023-10-12 15:31 – Updated: 2024-04-04 08:35
VLAI
Details
SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-27315"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-12T14:15:10Z",
"severity": "MODERATE"
},
"details": "SnapGathers versions prior to 4.9 are susceptible to a vulnerability \nwhich could allow a local authenticated attacker to discover plaintext \ndomain user credentials",
"id": "GHSA-683f-hcw3-5vgr",
"modified": "2024-04-04T08:35:35Z",
"published": "2023-10-12T15:31:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27315"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231009-0002"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6G92-JHV6-7WCP
Vulnerability from github – Published: 2025-03-05 06:31 – Updated: 2025-03-05 18:32
VLAI
Details
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-27662"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-05T06:15:38Z",
"severity": "CRITICAL"
},
"details": "Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.",
"id": "GHSA-6g92-jhv6-7wcp",
"modified": "2025-03-05T18:32:08Z",
"published": "2025-03-05T06:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27662"
},
{
"type": "WEB",
"url": "https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htm"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HQV-2JJV-PJCR
Vulnerability from github – Published: 2024-04-26 21:31 – Updated: 2024-07-03 18:37
VLAI
Details
Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
Severity
6.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-28325"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-26T19:15:47Z",
"severity": "MODERATE"
},
"details": "Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.",
"id": "GHSA-6hqv-2jjv-pjcr",
"modified": "2024-07-03T18:37:06Z",
"published": "2024-04-26T21:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28325"
},
{
"type": "WEB",
"url": "https://github.com/ShravanSinghRathore/ASUS-RT-N300-B1/wiki/Credentials-Stored-in-Cleartext-CVE%E2%80%902024%E2%80%9028325"
},
{
"type": "WEB",
"url": "http://asus.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Avoid storing passwords in easily accessible locations.
Mitigation
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.