Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2025-70798HIGHTenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attaEPSS 0.2%CVE-2025-70802HIGHTenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows aEPSS 0.2%CVE-2026-65117MEDIUMNVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successfulEPSS 0.2%CVE-2025-2555LOWAudi Universal Traffic Recorder App FTP Credentials hard-coded passwordEPSS 0.2%CVE-2023-23771HIGHMotorola MBTS Base Radio accepts hard-coded backdoor password. The Motorola MBTS Base Radio Man Machine Interface (MMI), allowing for servicEPSS 0.2%CVE-2024-48831HIGHDell SmartFabric OS10 Software, version(s) 10.5.6.x, contain(s) a Use of Hard-coded Password vulnerability. An unauthenticated attacker withEPSS 0.2%CVE-2024-28023MEDIUMA vulnerability exists in the message queueing mechanism that if exploited can lead to the exposure of resources or functionality to unintEPSS 0.2%CVE-2025-9806LOWTenda F1202 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-11666HIGHTenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordEPSS 0.2%CVE-2025-7741LOWHardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user account (PROG) used EPSS 0.2%CVE-2025-9380HIGHFNKvision Y215 CCTV Camera Firmware passwd hard-coded credentialsEPSS 0.2%CVE-2025-36609LOWDell SmartFabric OS10 Software, versions prior to 10.6.0.5, contains a Use of Hard-coded Password vulnerability. A low privileged attacker wEPSS 0.2%CVE-2026-97355—Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of ServiceEPSS 0.2%CVE-2025-9731LOWTenda AC9 Administrative shadow hard-coded credentialsEPSS 0.2%CVE-2025-11649HIGHTomofun Furbo 360/Furbo Mini Root Account hard-coded passwordEPSS 0.1%CVE-2025-9778LOWTenda W12 Administrative shadow hard-coded credentialsEPSS 0.1%CVE-2026-4993MEDIUMwandb OpenUI config.py hard-coded credentialsEPSS 0.1%CVE-2025-3920HIGHHard-coded Password in SUR-FBD CMMSEPSS 0.1%CVE-2025-15371HIGHTenda i24 Shadow File hard-coded credentialsEPSS 0.1%CVE-2025-57175MEDIUMSiklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.EPSS 0.1%