Weaknesses of type CWE-259

210 results

Senha codificada no código-fonte

Credenciais (senhas, tokens, chaves de API) inseridas diretamente no código-fonte ou em arquivos de configuração versionados no repositório. É perigoso porque qualquer pessoa com acesso ao código (desenvolvedores, ex-funcionários, repositórios públicos vazados) obtém acesso direto aos sistemas protegidos.

Example

Um desenvolvedor escreve `const dbPassword = 'admin123'; const conn = mysql.createConnection({host: 'localhost', user: 'root', password: dbPassword});` no arquivo app.js que fica versionado no Git. Quando o repositório vaza ou é copiado, o atacante tem a senha do banco de produção.

How to mitigate

Armazene credenciais em variáveis de ambiente (.env não versionado), cofres de segurança (Vault, AWS Secrets Manager) ou gestores de secrets do seu orquestrador (Kubernetes Secrets). Revise histórico do Git com ferramentas como git-secrets ou TruffleHog e rotacione qualquer credencial já exposta.

CVE-2024-39585HIGHDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. EPSS 0.3%CVE-2026-11515MEDIUMSourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordEPSS 0.3%CVE-2025-61330MEDIUMA hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. TEPSS 0.3%CVE-2026-6610MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2025-30106HIGHOn IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attackeEPSS 0.3%CVE-2026-2702LOWBeetel 777VR1 WPA2 PSK hard-coded credentialsEPSS 0.3%CVE-2022-26388MEDIUMUse of Hard-Coded Password Vulnerability in ELI Electrocardiograph DevicesEPSS 0.3%CVE-2021-27452—The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentiEPSS 0.3%CVE-2024-27164HIGHHardcoded credentialsEPSS 0.3%CVE-2024-7155LOWTOTOLINK A3300R shadow.sample hard-coded passwordEPSS 0.3%CVE-2025-54754HIGHCognex In-Sight Explorer and In-Sight Camera Firmware Use of Hard-coded PasswordEPSS 0.2%CVE-2026-22055MEDIUMActive IQ OneCollect version 2.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to performEPSS 0.2%CVE-2026-22054MEDIUMActive IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perEPSS 0.2%CVE-2025-1879LOWi-Drive i11/i12 APK hard-coded credentialsEPSS 0.2%CVE-2024-46328HIGHVONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root.EPSS 0.2%CVE-2025-7564HIGHLB-LINK BL-AC3600 shadow hard-coded credentialsEPSS 0.2%CVE-2023-0808LOWDeye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordEPSS 0.2%CVE-2024-46959MEDIUMrunofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows access to the /stream1EPSS 0.2%CVE-2025-9091LOWTenda AC20 shadow hard-coded credentialsEPSS 0.2%CVE-2025-47818LOWFlock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.EPSS 0.2%