Weaknesses of type CWE-259

224 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2025-14126HIGHTOZED ZLT M30S/ZLT M30S PRO Web hard-coded credentialsEPSS 0.4%CVE-2024-32210MEDIUMThe LoMag WareHouse Management application version 1.0.20.120 and older were to utilize hard-coded passwords by default for forms and SQL coEPSS 0.4%CVE-2025-7453MEDIUMsaltbo zpan JSON Web Token token.go NewToken hard-coded passwordEPSS 0.4%CVE-2025-2342MEDIUMIROAD X5 Mobile App API Endpoint hard-coded credentialsEPSS 0.4%CVE-2024-27774HIGHUnitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded PasswordEPSS 0.4%CVE-2026-35905CRITICALT3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access EPSS 0.4%CVE-2026-96548MEDIUMsfturing hosp_order jdbc.properties hard-coded credentialsEPSS 0.4%CVE-2025-7080MEDIUMDone-0 Jank JWT Token jwt_utils.go hard-coded passwordEPSS 0.4%CVE-2024-3699CRITICALHardcoded password in drEryk GabinetEPSS 0.4%CVE-2024-1228CRITICALHardcoded password in Eurosoft PrzychodniaEPSS 0.4%CVE-2025-6139LOWTOTOLINK T10 shadow.sample hard-coded passwordEPSS 0.4%CVE-2025-58081HIGHUse of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenEPSS 0.4%CVE-2025-2402HIGHHard-coded password for object store of KNIME Business HubEPSS 0.4%CVE-2026-25753CRITICALPlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover)EPSS 0.4%CVE-2023-29103MEDIUMA vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC712 (All versiEPSS 0.4%CVE-2025-25984MEDIUMAn issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execEPSS 0.4%CVE-2025-7577MEDIUMTeledyne FLIR FB-Series O/FLIR FH-Series ID hard-coded passwordEPSS 0.4%CVE-2014-5431—Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module (WBM) version 16 contains a hard-coded passEPSS 0.4%CVE-2026-86150MEDIUMTenda CP3 hostapd hard-coded credentialsEPSS 0.4%CVE-2025-9725LOWCudy LT500E Web shadow hard-coded passwordEPSS 0.4%