CVE-2016-6531

Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intranet TCP port 3306. NOTE: the vendor disputes this issue, stating that the "vulnerability note ... is factually false ... there is indeed a default blank password, but it can be changed ... We recommend that users change it, each customer receives direction.

• CWE-255

• http://www.kb.cert.org/vuls/id/619767Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/GWAN-ACVSBMThird Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/92780
• http://www.kb.cert.org/vuls/id/619767Third Party Advisory, US Government Resource
• http://www.kb.cert.org/vuls/id/GWAN-ACVSBMThird Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/92780

Published

Sep 24, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6522Integer overflow in the uvm_map_isavail function in uvm/uvm_…
• CVE-2016-6523Multiple cross-site scripting (XSS) vulnerabilities in the m…
• CVE-2016-6525Heap-based buffer overflow in the pdf_load_mesh_params funct…
• CVE-2016-6526The SpamCall Activity component in Telecom application on Sa…
• CVE-2016-6527The SmartCall Activity component in Telecom application on S…
• CVE-2016-6530Dentsply Sirona (formerly Schick) CDR Dicom 5 and earlier ha…
• CVE-2016-6532DEXIS Imaging Suite 10 has a hardcoded password for the sa a…
• CVE-2016-6534Opmantek NMIS before 4.3.7c has command injection via man, f…
• CVE-2016-6535AVer Information EH6108H+ devices with firmware X9.03.24.00.…
• CVE-2016-6536The /setup URI on AVer Information EH6108H+ devices with fir…
• CVE-2016-6537AVer Information EH6108H+ devices with firmware X9.03.24.00.…
• CVE-2016-6538The TrackR Bravo mobile app stores the account password used…