Weaknesses of type CWE-256

224 results

Senha codificada ou armazenamento em texto plano

É quando a senha ou credencial fica gravada direto no código-fonte, arquivo de configuração ou banco de dados sem criptografia. Qualquer um com acesso ao código, binário ou logs consegue ler a senha e comprometer sistemas. O risco aumenta exponencialmente se o código for versionado, distribuído ou ficar exposto em repositórios públicos.

Example

Um desenvolvedor escreve 'password = "admin123"' em uma variável de conexão ao banco, ou deixa credenciais de API em um arquivo .env commitado no Git. Um atacante clona o repositório ou decompila a aplicação e já tem acesso a sistemas críticos.

How to mitigate

Armazene senhas em gerenciadores de segredos (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault), use variáveis de ambiente seguras, nunca commite credenciais no versionamento, e implemente rotação automática de senhas. Em bancos de dados, sempre aplique hash com salt (bcrypt, Argon2) em vez de armazenar em texto plano.

CVE-2019-0032MEDIUMJunos Space Service Now and Service Insight: Organization username and password stored in plaintext in log files.EPSS 0.4%CVE-2024-39220MEDIUMBAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-EPSS 0.4%CVE-2020-25184HIGHRockwell Automation ISaGRAF5 Runtime Unprotected Storage of CredentialsEPSS 0.4%CVE-2024-5960CRITICALPlaintext Storage of a Password in Eliz Software's PanelEPSS 0.4%CVE-2023-26204LOWA plaintext storage of a password vulnerability [CWE-256] in FortiSIEM 6.7 all versions, 6.6 all versions, 6.5 all versions, 6.4 all versionEPSS 0.4%CVE-2026-46513HIGHFrogman: API tokens stored in plaintextEPSS 0.4%CVE-2024-3623MEDIUMMirror-registry: default database secret key stored in plain-text on initial configuration fileEPSS 0.4%CVE-2025-56527HIGHPlaintext password storage in Kotaemon 0.11.0 in the client's localStorage.EPSS 0.4%CVE-2024-41336HIGHDraytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior EPSS 0.4%CVE-2023-42493HIGH EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEPSS 0.4%CVE-2024-40116HIGHAn issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,EPSS 0.4%CVE-2023-48700MEDIUMClear Text Credentials Exposed via Onboarding TaskEPSS 0.4%CVE-2023-2633MEDIUMAPI keys stored and displayed in plain text by Code Dx Plugin EPSS 0.4%CVE-2024-25138MEDIUMAutomationDirect C-MORE EA9 HMI Plaintext Storage of a PasswordEPSS 0.4%CVE-2023-41610HIGHVicture PC420 1.1.39 was discovered to contain a hardcoded root password which is stored in plaintext.EPSS 0.4%CVE-2026-40430HIGHPlaintext Storage of a Password in Panduit IntraVUE by PronetiqsEPSS 0.4%CVE-2024-4425MEDIUMStoring credentials in plaintext in CemiParkEPSS 0.4%CVE-2025-2500CRITICALA vulnerability exists in the SOAP Web services of the Asset Suite versions listed below. If successfully exploited, an attacker could gaiEPSS 0.4%CVE-2025-15624CRITICALPlaintext Storage of a Password in Sparx Pro Cloud Server.EPSS 0.4%CVE-2025-1709MEDIUMCVE-2025-1709EPSS 0.4%