Weaknesses of type CWE-489

106 results

Código de depuração deixado em produção

Código temporário de debug — logs verbosos, print statements, rotas de teste, funcionalidades desativadas com comentários — permanece na aplicação em produção. Isso expõe informações sensíveis (stack traces, caminhos internos, tokens) e pode criar portas traseiras acidentais que atacantes exploram para contornar autenticação ou acessar recursos restritos.

Example

Um desenvolvedor deixa um endpoint `/admin/test` acessível sem autenticação para testar fluxos, ou uma função de debug que imprime credenciais no log de erros. Um atacante descobre e usa isso para ganhar acesso administrativo ou extrair secrets.

How to mitigate

Remova todo código de debug antes do merge para produção (code review obrigatório), use variáveis de ambiente para controlar níveis de log (nunca verbose em prod), e automatize a detecção com linters que flagrem console.log, print() ou rotas de teste conhecidas. Mantenha debug apenas em branches isolados ou ambientes de staging.

CVE-2025-42872MEDIUMCross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise PortalEPSS 0.3%CVE-2025-52663HIGHA vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This iEPSS 0.2%CVE-2026-65893HIGHArbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP CameraEPSS 0.2%CVE-2025-7705HIGHAuthentication bypass due to compatibility mode enabled by defaultEPSS 0.2%CVE-2026-83550HIGHPostgres-exporter: net/http/pprof exposed on metrics listenerEPSS 0.2%CVE-2026-100295MEDIUMActive debug code in Anjvision YSSD-RTMP-H5EPSS 0.2%CVE-2024-29075MEDIUMActive debug code vulnerability exists in Mesh Wi-Fi router RP562B firmware version v1.0.2 and earlier. If this vulnerability is exploited, EPSS 0.2%CVE-2026-15575MEDIUMSensitive Information Disclosure Due to Enabled Debug Mode in Production in SFM Software's CostifierEPSS 0.2%CVE-2026-120637—CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHODEPSS 0.2%CVE-2022-38453LOWContec Health CMS8000EPSS 0.2%CVE-2026-81943HIGHPLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCEEPSS 0.2%CVE-2026-64529HIGHcrypto: qat - remove unused character device and IOCTLsEPSS 0.2%CVE-2026-54799HIGHA vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < VEPSS 0.2%CVE-2026-33201HIGHDigital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., LTD. contains an active debug code vulnerability. If this vulnerability is exploiEPSS 0.2%CVE-2026-50228MEDIUMElectron DevTools Arbitrary Code Execution Vulnerability in NitroSenseEPSS 0.2%CVE-2026-6485HIGHUEFI BIOS embedded Shell can be used to bypass Secure BootEPSS 0.2%CVE-2023-21496MEDIUMActive Debug Code vulnerability in ActivityManagerService prior to SMR May-2023 Release 1 allows attacker to use debug function via setting EPSS 0.2%CVE-2025-54660MEDIUMAn active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.10, FortiClientWEPSS 0.2%CVE-2025-1479MEDIUMAn open debug interface was reported in the Legion Space software included on certain Legion devices that could allow a local attacker to exEPSS 0.2%CVE-2025-2486LOWUEFI Shell accessible in AAVMF with Secure Boot enabled on UbuntuEPSS 0.1%