Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2026-121609CRITICALQihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentialsEPSS 0.5%CVE-2026-93970MEDIUMaiyiyi121 SxDevOps Settings settings.py hard-coded credentialsEPSS 0.5%CVE-2026-93969MEDIUMaiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentialsEPSS 0.5%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.5%CVE-2026-7251CRITICALEppendorf BioFlo 320 Use of hard-coded passwordEPSS 0.5%CVE-2023-50948MEDIUMIBM Storage Fusion HCI information disclosureEPSS 0.5%CVE-2026-86276MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentialsEPSS 0.5%CVE-2026-78062MEDIUMvas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentialsEPSS 0.5%CVE-2024-2038HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded CredentialsEPSS 0.5%CVE-2022-29825MEDIUMUse of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) veEPSS 0.5%CVE-2025-44955HIGHRUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.EPSS 0.5%CVE-2020-12037—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TEPSS 0.5%CVE-2026-86673MEDIUMningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentialsEPSS 0.5%CVE-2024-37644HIGHTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackerEPSS 0.5%CVE-2026-82808MEDIUMInbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.4%CVE-2025-30115CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSEPSS 0.4%CVE-2024-7216LOWTOTOLINK LR1200 shadow.sample hard-coded passwordEPSS 0.4%CVE-2026-112146MEDIUMD-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentialsEPSS 0.4%CVE-2024-35395HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attaEPSS 0.4%