Weaknesses of type CWE-259

210 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2022-41653CRITICALDaikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials andEPSS 0.7%CVE-2023-41030MEDIUMJuplink RX4-1500 Hard-coded Credential VulnerabilityEPSS 0.7%CVE-2024-43423CRITICALDover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded PasswordEPSS 0.7%CVE-2025-8231HIGHD-Link DIR-890L UART Port rgbin hard-coded credentialsEPSS 0.7%CVE-2024-11630MEDIUME-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentialsEPSS 0.6%CVE-2024-11026MEDIUMIntelligent Apps Freenow App Keystore SSL.java hard-coded passwordEPSS 0.6%CVE-2024-27488CRITICALIncorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain senEPSS 0.6%CVE-2024-32741CRITICALA vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains hard coded password which is usedEPSS 0.6%CVE-2025-11126CRITICALApeman ID71 system.ini hard-coded credentialsEPSS 0.6%CVE-2024-31810CRITICALTOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.EPSS 0.6%CVE-2023-41713—SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function.EPSS 0.6%CVE-2025-15111CRITICALKsenia Security lares Home Automation 1.6 Default Credentials VulnerabilityEPSS 0.6%CVE-2024-28010CRITICALUse of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, WEPSS 0.6%CVE-2025-9310MEDIUMyeqifu carRental Druid login.html hard-coded credentialsEPSS 0.6%CVE-2024-34025CRITICALCyberPower PowerPanel business Use of Hard-coded PasswordEPSS 0.6%CVE-2024-42639CRITICALH3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2024-7159MEDIUMTOTOLINK A3600R Telnet Service product.ini hard-coded passwordEPSS 0.6%CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2023-2061MEDIUMAuthentication bypass vulnerability in MELSEC iQ-R Series / iQ-F Series EtherNet/IP ModulesEPSS 0.5%CVE-2024-34211HIGHTOTOLINK CP450 v4.1.0cu.747_B20191224 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attacEPSS 0.5%