Weakness (CWE)
CWE-489: Active Debug Code
The product is released with debugging code still enabled or active.
How to prevent it (1 mitigation)
-
Build and Compilation, Distribution
Remove debug code before deploying the application.
Source: MITRE CWE-489
22 results · Clear filters · Feed
-
Critical 9.8
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD
CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD. For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the…
-
Critical 9.5
RCE via exposed JDWP debug agent in P4Search
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the conne…
-
Critical 9.3
Cadmos LTI exposure of sensitive information via debug mode
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Larave…
-
Critical 9.1
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including s…
-
Critical 9.8
GetSimple CMS & GetSimpleCMS-CE have an Unauthenticated Admin Account Creation via Setup Logic Flaw
GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administr…
-
Critical 9.0
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug…
-
Critical 9.1
stigmem-node Insecure Federation Transport Configuration
stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-l…
-
Critical 9.1
Unfurl - Werkzeug Debugger Exposure via String Config Parsing
Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate…
-
Critical 9.8CVE-2024-9644 Public exploit
Four-Faith F3x36 bapply.cgi Auth Bypass
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to an authentication bypass vulnerability in the administrative web server. Authentication is not enforced on some administrative functionality when using the "bapply.cgi" endpoint instead of the…
-
Critical 9.8CVE-2024-9643 Scanner template
Four-Faith F3x36 Hidden Debug Credentials
The Four-Faith F3x36 router using firmware v2.0.0 is vulnerable to authentication bypass due to hard-coded credentials in the administrative web server. An attacker with knowledge of the credentials can gain administrative access via crafted HTTP requests. Th…
-
Critical 9.8
Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root p…
-
Critical 9.8
A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E…
-
Critical 9.8
CyberPower PowerPanel business Active Debug Code
Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaining access to the testing or production server.
-
Critical 9.8
Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, …
-
Critical 10.0
Quantum HD Unity
An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed.
-
Critical 9.8CVE-2023-32645 EPSS 55%
A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A…
-
Critical 9.8
A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_2022110…
-
Critical 9.8
SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/studen…
-
Critical 9.8
Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS…
-
Critical 9.1
A command execution vulnerability exists in the clish art2 functionality of Robustel R1510 3.3.0. A specially-crafted n…
-
Critical 9.9
A command execution vulnerability exists in the console inhand functionality of InHand Networks InRouter302 V3.5.4. A s…
-
Critical 10.0
A firmware update vulnerability exists in the 'factory' binary of reolink RLC-410W v3.0.0.136_20121102. A specially-cra…