Weaknesses of type CWE-798

1,006 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2024-10025CRITICALVulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xxEPSS 0.8%CVE-2023-35987CRITICALPiiGAB M-Bus Use of Hard-coded CredentialsEPSS 0.8%CVE-2020-2500CRITICALThis improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensEPSS 0.7%CVE-2023-1269MEDIUMUse of Hard-coded Credentials in alextselegidis/easyappointmentsEPSS 0.7%CVE-2023-2138CRITICALUse of Hard-coded Credentials in nuxtlabs/github-moduleEPSS 0.7%CVE-2025-4041CRITICALUse of Hard-coded Credentials Optigo Networks ONS NC600EPSS 0.7%CVE-2019-25241CRITICALFaceSentry Access Control System 6.4.8 Remote SSH Root AccessEPSS 0.7%CVE-2023-39420CRITICALUse of Hard-coded Credentials in RDPCore.dllEPSS 0.7%CVE-2024-23816CRITICALA vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location IntelligenEPSS 0.7%CVE-2026-1610CRITICALTenda AX12 Pro V2 Telnet Service hard-coded credentialsEPSS 0.7%CVE-2025-46352CRITICALConsilium Safety CS5000 Fire Panel Use of Hard-coded CredentialsEPSS 0.7%CVE-2019-10995—ABB CP651 HMI products revision BSP UN30 v1.76 and prior implement hidden administrative accounts that are used during the provisioning phasEPSS 0.7%CVE-2021-33540HIGHPhoenix Contact: Undocumented FTP acces in certain AXL F BK and IL BK devicesEPSS 0.7%CVE-2021-33531HIGHWEIDMUELLER: WLAN devices affected by Hard-coded Credentials vulnerabilityEPSS 0.7%CVE-2024-8005MEDIUMdemozx gf_cms JWT Authentication auth.go init hard-coded credentialsEPSS 0.7%CVE-2024-1039CRITICALUse of Hard-coded Credentials in Gessler GmbH WEB-MASTEREPSS 0.7%CVE-2025-26410CRITICALWeak Hard-coded CredentialsEPSS 0.7%CVE-2024-31151HIGHA security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during theEPSS 0.7%CVE-2025-2322MEDIUM274056675 springboot-openai-chatgpt OpenController.java hard-coded credentialsEPSS 0.7%CVE-2023-26566HIGHSangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackeEPSS 0.7%