CWE-260
Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
Impactr finds and proves whether CWE-260 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.