Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2021-33529HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.9%CVE-2025-10639HIGHUsage of Hardcoded FTP Credentials EfficientLab WorkExaminer ProfessionalEPSS 0.9%CVE-2023-48388CRITICALMultisuns EasyLog web+ - Use of Hard-coded PasswordEPSS 0.9%CVE-2022-28812CRITICALUse of Hard-coded Credentials in UWP3.0 allows SuperUser authentication bypass in Car Park Server.EPSS 0.9%CVE-2024-10451MEDIUMOrg.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processEPSS 0.9%CVE-2021-45033—A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/EPSS 0.9%CVE-2024-2161CRITICALUse of Hard-coded Credentials in Kiloview NDI N series products API middlewareEPSS 0.9%CVE-2023-39169CRITICALSENEC: Storage Box V1,V2 and V3 using default credentialsEPSS 0.9%CVE-2023-26511CRITICALA Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain acEPSS 0.9%CVE-2025-59091CRITICALHardcoded Legacy Accounts Allowing Control Over Access Managers in dormakaba Kaba exos 9300EPSS 0.9%CVE-2025-59092HIGHUnauthenticated RPC Service in dormakaba Kaba exos 9300EPSS 0.9%CVE-2016-9495—Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentialsEPSS 0.9%CVE-2023-24155CRITICALTOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-biEPSS 0.9%CVE-2018-10898HIGHA vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configuratEPSS 0.9%CVE-2025-27643CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.EPSS 0.9%CVE-2021-33014HIGHKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 0.9%CVE-2025-69425CRITICALRuckus vRIoT IoT Controller < 3.0.0.0 Hardcoded Tokens RCEEPSS 0.9%CVE-2025-56157CRITICALDefault credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source coEPSS 0.9%CVE-2022-4333CRITICALSprecher: Sprecon maintenance access with hardcoded credentialsEPSS 0.9%CVE-2024-52295CRITICALDataEase has a forged JWT token vulnerabilityEPSS 0.9%