Weaknesses of type CWE-798

941 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2026-73519CRITICALWolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-SecretEPSS 0.8%CVE-2016-20026CRITICALZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code ExecutionEPSS 0.8%CVE-2024-41611CRITICALIn D-Link DIR-860L REVA FIRMWARE PATCH 1.10..B04, the Telnet service contains hardcoded credentials, enabling attackers to log in remotely tEPSS 0.8%CVE-2024-29063HIGHAzure AI Search Information Disclosure VulnerabilityEPSS 0.8%CVE-2025-35451CRITICALPan-Tilt-Zoom cameras hard-coded default passwords with SSH and telnet enabledEPSS 0.8%CVE-2022-44096CRITICALSanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and accessEPSS 0.8%CVE-2022-44097CRITICALBook Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access tEPSS 0.8%CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-47281CRITICALVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2022-38337CRITICALWhen aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid loginEPSS 0.8%CVE-2024-10025CRITICALVulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxEPSS 0.8%CVE-2022-39273MEDIUMDefault OAuth Authorization Server secret in FlyteAdminEPSS 0.8%CVE-2023-35987CRITICALPiiGAB M-Bus Use of Hard-coded CredentialsEPSS 0.8%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2138CRITICALUse of Hard-coded Credentials in nuxtlabs/github-moduleEPSS 0.7%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2023-39420CRITICALUse of Hard-coded Credentials in RDPCore.dllEPSS 0.7%CVE-2024-23816CRITICALA vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenEPSS 0.7%CVE-2019-10995—ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasEPSS 0.7%