Weakness (CWE)
CWE-489: Active Debug Code
The product is released with debugging code still enabled or active.
How to prevent it (1 mitigation)
-
Build and Compilation, Distribution
Remove debug code before deploying the application.
Source: MITRE CWE-489
36 results · Clear filters · Feed
-
Medium 5.3
Sensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's Costifier
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
-
Medium 6.3
Active debug code in Anjvision YSSD-RTMP-H5
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally prov…
-
Medium 6.1
Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, t…
-
Medium 6.7
PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE
PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug functionality in the embedded software. An attacker with privileged access to the device can enable this debug mode to exe…
-
Medium 6.0
Unauthenticated Go pprof exposure in Calico debug server
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the pr…
-
Medium 6.7
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base sys…
-
Medium 6.5
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base sys…
-
Medium 6.5
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 10.7.0, Appium's base-driver unconditionally mounts the /test/guinea-pig, /test/guinea-pig-scrollable, and /test/guinea-pig-app-banner …
-
Medium 5.3CVE-2026-32662 Public exploit
Gardyn Cloud API Active Debug Code
Development and test API endpoints are present that mirror production functionality.
-
Medium 6.8
Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vu…
-
Medium 5.5
Sprig Plugin for Craft CMS potentially discloses sensitive information via Sprig Playground
The Sprig Plugin for Craft CMS is a reactive Twig component framework for Craft CMS. Starting in version 2.0.0 and prior to versions 2.15.2 and 3.15.2, admin users, and users with explicit permission to access the Sprig Playground, could potentially expose th…
-
Medium 6.1
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal, an unauthenticated attacker could inject malicious scripts that execute in the context of other users� browsers, allowing the attacker to steal session cookies, tokens, and …
-
Medium 4.9
An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through…
-
Medium 5.5
Leftover Debug Code in Secure Element
Information disclosure while capturing logs as eSE debug messages are logged.
-
Medium 6.8
Authentication bypass due to compatibility mode enabled by default
: Active Debug Code vulnerability in ABB Switch Actuator 4 DU-83330, ABB Switch actuator, door/light 4 DU -83330-500.This issue affects Switch Actuator 4 DU-83330: All Versions; Switch actuator, door/light 4 DU -83330-500: All Versions.
-
Medium 5.3
An open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a…
-
Medium 6.8
Netis WF-2404 UART hardware allows activation of test or debug logic at runtime
A vulnerability was found in Netis WF-2404 1.1.124EN. It has been declared as critical. This vulnerability affects unknown code of the component UART. The manipulation leads to hardware allows activation of test or debug logic at runtime. It is possible to la…
-
Medium 6.8
A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.90), SIPROTEC 5 6MD85 (CP200) (All v…
-
Medium 4.6
Active debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnera…
-
Medium 6.8
Smart-tab Android app installed April 2023 or earlier contains an active debug code vulnerability. If this vulnerabilit…
-
Medium 6.8
A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to …
-
Medium 6.8
Active debug code vulnerability exists in PLANEX COMMUNICATIONS wireless LAN routers. If a logged-in user who knows how…
-
Medium 5.3
ioLogik 4000 Series: Existence of an Unauthorized Service
A vulnerability has been identified in the ioLogik 4000 Series (ioLogik E4200) firmware versions v1.6 and prior, which can be exploited by malicious actors to potentially gain unauthorized access to the product. This could lead to security breaches, data thef…
-
Medium 6.1
Active Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug …
-
Medium 4.3
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the httpd port 4444 upload.cgi functionality of InHand Networks InRouter3…
-
Medium 4.9
A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A…
-
Medium 6.5
A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45.…
-
Medium 6.5
A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. …
-
Medium 6.7CVE-2021-3972 Public exploit
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS …
-
Medium 6.7
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook device…
-
Medium 6.5
Possible Access to Debug Functions in Bosch VRM / BVMS
By executing a special command, an user with administrative rights can get access to extended debug functionality on the VRM allowing an impact on integrity or availability of the installed software. This issue also affects installations of the DIVAR IP and B…
-
Medium 6.1
Cisco IOS XE Software Active Debug Code Vulnerability
A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with high privileges or an unauthenticated attacker with physical access to the device to open a debugging console. The vulnerability is due to insufficient command authoriz…
-
Medium 5.1
Cisco IOS and IOS XE Software Privilege Escalation Vulnerability
A vulnerability in the dragonite debugger of Cisco IOS XE Software could allow an authenticated, local attacker to escalate from privilege level 15 to root privilege. The vulnerability is due to the presence of development testing and verification scripts tha…
-
Medium 6.8
Cisco IOS XE Software Arbitrary Code Execution Vulnerability
A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated, local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affec…
-
Medium 6.4
An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.