Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2022-26388MEDIUMUse of Hard-Coded Password Vulnerability in ELI Electrocardiograph DevicesEPSS 0.3%CVE-2026-108831MEDIUMmeetecho janus-gateway Admin API admin.js hard-coded credentialsEPSS 0.3%CVE-2024-27164HIGHHardcoded credentialsEPSS 0.3%CVE-2025-54754HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded PasswordEPSS 0.3%CVE-2024-7155LOWTOTOLINK A3300R shadow.sample hard-coded passwordEPSS 0.3%CVE-2025-1879LOWi-Drive i11/i12 APK hard-coded credentialsEPSS 0.2%CVE-2026-22054MEDIUMActive IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perEPSS 0.2%CVE-2026-22055MEDIUMActive IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to performEPSS 0.2%CVE-2025-47818LOWFlock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.EPSS 0.2%CVE-2025-47823LOWFlock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.EPSS 0.2%CVE-2025-9091LOWTenda AC20 shadow hard-coded credentialsEPSS 0.2%CVE-2024-46328HIGHVONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root.EPSS 0.2%CVE-2023-0808LOWDeye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordEPSS 0.2%CVE-2024-46959MEDIUMrunofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1EPSS 0.2%CVE-2025-47821LOWFlock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.EPSS 0.2%CVE-2025-9309LOWTenda AC10 MD5 Hash shadow hard-coded credentialsEPSS 0.2%CVE-2024-33867MEDIUMAn issue was discovered in linqi before 1.4.0.1 on Windows. There is a hardcoded password salt.EPSS 0.2%CVE-2023-1944HIGH[minikube] ssh server with default passwordEPSS 0.2%CVE-2024-20412CRITICALA vulnerability in Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 1000, 2100, 3100, and 4200 Series could allow an unauthEPSS 0.2%CVE-2026-123135MEDIUMlanggenius dify Sandbox Run __init__.py hard-coded credentialsEPSS 0.2%