Weaknesses of type CWE-259

210 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2026-19901CRITICALLB-LINK X-PRO easycwmp hard-coded credentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.4%CVE-2024-7216LOWTOTOLINK LR1200 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-70041CRITICALAn issue pertaining to CWE-259: Use of Hard-coded Password was discovered in oslabs-beta ThermaKube master.EPSS 0.4%CVE-2024-35395HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attaEPSS 0.4%CVE-2025-30115CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSEPSS 0.4%CVE-2024-32210MEDIUMThe LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL coEPSS 0.4%CVE-2024-27774HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded PasswordEPSS 0.4%CVE-2025-11284MEDIUMZytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded passwordEPSS 0.4%CVE-2025-2342MEDIUMIROAD X5 Mobile App API Endpoint hard-coded credentialsEPSS 0.4%CVE-2026-35905CRITICALT3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access EPSS 0.4%CVE-2024-3699CRITICALHardcoded password in drEryk GabinetEPSS 0.4%CVE-2024-1228CRITICALHardcoded password in Eurosoft PrzychodniaEPSS 0.4%CVE-2025-14126HIGHTOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentialsEPSS 0.4%CVE-2025-6139LOWTOTOLINK T10 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-58081HIGHUse of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenEPSS 0.4%CVE-2023-29103MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versiEPSS 0.4%CVE-2025-7453MEDIUMsaltbo zpan JSON Web Token token.go NewToken hard-coded passwordEPSS 0.4%CVE-2025-25984MEDIUMAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%