Not a bug, but a government web system to have control over financial expenses from a region in my country has the login access admin:admin.
Somehow they manage to keep it like that for years with no problem.

'without a problem'

If someone from the outside was being a 'problem' and they were good at it ... you wouldn't know.

@N00bPancakes that's a good point, but those entries are public information, this system was like a pre-control to make them public later, not to be touched again, so maybe they didn't care that much, they asked me to delete all entries from the DB to not have a lot of noise

If I found something like this I would do everything in my power to keep the records consistent with everything else, so as to avoid an investigation.