("admin/admin" or similar). If these aren't changed, an opponent can literally merely log in. inside 2016 famously contaminated thousands of IoT devices by simply trying a listing of arrears passwords for equipment like routers in addition to cameras, since customers rarely changed these people. - Directory listing enabled over a website server, exposing almost all files if simply no index page will be present. This might reveal sensitive files. - Leaving debug mode or verbo