Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2023-5222MEDIUMViessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded passwordEPSS 80.4%CVE-2026-20316MEDIUMCisco Secure Firewall Management Center Software Static Credential VulnerabilityEPSS 35.1%KEVCVE-2024-7332CRITICALTOTOLINK CP450 Telnet Service product.ini hard-coded passwordEPSS 20.7%CVE-2012-5862—Sinapsi eSolar Hard-Coded PasswordEPSS 12.1%CVE-2025-57788MEDIUMUnauthorized API Access RiskEPSS 7.8%CVE-2023-51629MEDIUMD-Link DCS-8300LHV2 ONVIF Hardcoded PIN Authentication Bypass VulnerabilityEPSS 3.9%CVE-2025-8730CRITICALBelkin F9K1009/F9K1010 Web Interface hard-coded credentialsEPSS 3.7%CVE-2023-2645CRITICALUSR USR-G806 Web Management Page hard-coded passwordEPSS 3.2%CVE-2026-19900CRITICALLB-LINK X-PRO shadow hard-coded credentialsEPSS 2.9%CVE-2014-5405—Hospira MedNet Use of Hard-coded PasswordEPSS 2.3%CVE-2016-9358—A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 terminal associated with the following systems: A320, A32EPSS 2.1%CVE-2014-2363—Morpho Itemiser 3 Hard-Coded CredentialEPSS 2.1%CVE-2015-3953—Hard-coded accounts may be used to access Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and EPSS 2.0%CVE-2020-12016—Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,EPSS 1.9%CVE-2021-22729—A CWE-259: Use of Hard-coded Password vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink PEPSS 1.8%CVE-2019-3908—Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An aEPSS 1.8%CVE-2017-6022—A hard-coded password issue was discovered in Becton, Dickinson and Company (BD) PerformA, Version 2.0.14.0 and prior versions, and KLA JourEPSS 1.8%CVE-2021-32525CRITICALQSAN Storage Manager - Use of Hard-coded Password-2EPSS 1.7%CVE-2021-21818HIGHA hard-coded password vulnerability exists in the Zebra IP Routing Manager functionality of D-LINK DIR-3040 1.13B03. A specially crafted netEPSS 1.7%CVE-2020-12047—The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24), when used with a Baxter Spectrum v8.x (model 35700BAX2) in a factory-defaEPSS 1.7%