Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-57579HIGHAn issue in TOTOLINK Wi-Fi 6 Router Series Device X2000R-Gh-V2.0.0 allows a remote attacker to execute arbitrary code via the default passwoEPSS 0.6%CVE-2022-3927HIGHThe affected products store public and private key that are used to sign and protect custom parameter set files from modification.EPSS 0.6%CVE-2025-28388CRITICALOpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.EPSS 0.6%CVE-2021-43717CRITICALAn issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can aEPSS 0.6%CVE-2023-23132HIGHSelfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys.EPSS 0.6%CVE-2026-53709CRITICALMCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryEPSS 0.6%CVE-2026-49352CRITICAL9Router: Hardcoded Default fallback JWT Secret Allows Authentication BypassEPSS 0.6%CVE-2025-51536CRITICALAustrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password.EPSS 0.6%CVE-2025-6950CRITICALAn Use of Hard-coded Credentials vulnerability has been identified in Moxa’s network security appliances and routers. The system employs a hEPSS 0.6%CVE-2025-9310MEDIUMyeqifu carRental Druid login.html hard-coded credentialsEPSS 0.6%CVE-2022-50696CRITICALSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Hardcoded Credentials Authentication BypassEPSS 0.6%CVE-2022-22466MEDIUMIBM Security Verify Governance information disclosureEPSS 0.6%CVE-2026-76708CRITICALUnauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)EPSS 0.6%CVE-2023-33778CRITICALDraytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.EPSS 0.6%CVE-2024-28751CRITICALifm: Hardcoded telnet credentials in Smart PLCEPSS 0.6%CVE-2025-48491LOWProject AI API Key Exposure in Source CodeEPSS 0.6%CVE-2023-5456HIGHA CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacEPSS 0.6%CVE-2024-46429HIGHA hardcoded credentials vulnerability in Tenda W18E V16.01.0.8(1625) allows unauthenticated remote attackers to access the web management poEPSS 0.6%CVE-2024-42450CRITICALThe Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function EPSS 0.6%CVE-2025-57577HIGHAn issue in H3C Device R365V300R004 allows a remote attacker to execute arbitrary code via the default password. NOTE: the Supplier's positiEPSS 0.6%