Weaknesses of type CWE-259

210 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2023-46685CRITICALA hard-coded password vulnerability exists in the telnetd functionality of LevelOne WBR-6013 RER4_A_v3411b_2T2R_LEV_09_170623. A set of specEPSS 1.0%CVE-2024-4708CRITICALmySCADA myPRO Use of Hard-coded PasswordEPSS 1.0%CVE-2019-10881CRITICALDefault hidden Privileged Account Vulnerability in multiple XEROX devicesEPSS 1.0%CVE-2022-45444CRITICALCVE-2022-45444EPSS 0.9%CVE-2022-22144HIGHA hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_0EPSS 0.9%CVE-2023-3237MEDIUMOTCMS hard-coded passwordEPSS 0.9%CVE-2023-32145HIGHD-Link DAP-1360 Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2024-29011HIGHUse of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlieEPSS 0.9%CVE-2025-27638CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.EPSS 0.9%CVE-2024-36526CRITICALZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.EPSS 0.9%CVE-2014-125030MEDIUMtaoeffect Empress hard-coded passwordEPSS 0.9%CVE-2018-25069HIGHNetis Netcore Router hard-coded passwordEPSS 0.9%CVE-2023-2799MEDIUMcnoa OA hard-coded passwordEPSS 0.8%CVE-2025-1100CRITICALA CWE-259 "Use of Hard-coded Password" for the root account in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticatedEPSS 0.8%CVE-2024-41616HIGHD-Link DIR-300 REVA FIRMWARE v1.06B05_WW contains hardcoded credentials in the Telnet service.EPSS 0.8%CVE-2024-7170MEDIUMTOTOLINK A3000RU product.ini hard-coded passwordEPSS 0.7%CVE-2021-32521HIGHQSAN Storage Manager, XEVO, SANOS - Use of Hard-coded PasswordEPSS 0.7%CVE-2025-7079MEDIUMmao888 bluebell-plus JWT Token jwt.go hard-coded passwordEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%