Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2023-35724HIGHD-Link DAP-2622 Telnet CLI Use of Hardcoded Credentials Authentication Bypass VulnerabilityEPSS 0.9%CVE-2023-37287CRITICALSmartBPM.NET - Use of Hard-Coded Credentials - 2EPSS 0.9%CVE-2020-5222MEDIUMHard-Coded Key Used For Remember-me Token in OpenCastEPSS 0.9%CVE-2022-42980CRITICALgo-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.EPSS 0.9%CVE-2022-48113CRITICALA vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POSTEPSS 0.9%CVE-2021-45033—A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/EPSS 0.9%CVE-2026-28778HIGHHardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100EPSS 0.9%CVE-2021-33529HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.9%CVE-2025-10639HIGHUsage of Hardcoded FTP Credentials EfficientLab WorkExaminer ProfessionalEPSS 0.9%CVE-2023-48388CRITICALMultisuns EasyLog web+ - Use of Hard-coded PasswordEPSS 0.9%CVE-2022-39273MEDIUMDefault OAuth Authorization Server secret in FlyteAdminEPSS 0.9%CVE-2024-10451MEDIUMOrg.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build processEPSS 0.9%CVE-2022-20844MEDIUMCisco Software-Defined Application Visibility and Control on Cisco vManage Static Username and Password VulnerabilityEPSS 0.9%CVE-2021-33014HIGHKUKA KR C4 - Use of Hard-Coded CredentialsEPSS 0.9%CVE-2024-2161CRITICALUse of Hard-coded Credentials in Kiloview NDI N series products API middlewareEPSS 0.9%CVE-2025-27643CRITICALVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.EPSS 0.9%CVE-2023-39169CRITICALSENEC: Storage Box V1,V2 and V3 using default credentialsEPSS 0.9%CVE-2023-26511CRITICALA Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain acEPSS 0.9%CVE-2016-9495—Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentialsEPSS 0.9%CVE-2023-24155CRITICALTOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-biEPSS 0.9%