Weaknesses of type CWE-798

943 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-48491LOWProject AI API Key Exposure in Source CodeEPSS 0.6%CVE-2024-38648CRITICALA hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uEPSS 0.6%CVE-2023-43583MEDIUMCryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allowEPSS 0.6%CVE-2022-27600MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.6%CVE-2021-27503—Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior tEPSS 0.6%CVE-2024-42637CRITICALH3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.EPSS 0.6%CVE-2024-42638CRITICALH3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as rooEPSS 0.6%CVE-2023-48251HIGHThe vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.EPSS 0.6%CVE-2025-7072CRITICALHardcoded credentials in KAON CG3000T/CG3000CT routersEPSS 0.6%CVE-2025-45784CRITICALD-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVIS_USER_PASSWORD, which may expose sensitive usEPSS 0.6%CVE-2021-47796CRITICALDenver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)EPSS 0.6%CVE-2025-7768CRITICALUse of Hard-coded Credentials in Tigo Energy Cloud Connect AdvancedEPSS 0.6%CVE-2023-49253CRITICALPredefined root passwordEPSS 0.6%CVE-2025-40537HIGHSolarWinds Web Help Desk Hardcoded Credentials VulnerabilityEPSS 0.6%CVE-2025-46273CRITICALPlanet Technology Network Products Use of Hard-coded CredentialsEPSS 0.6%CVE-2025-54455CRITICALUse of Hard-coded Credentials vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicIEPSS 0.6%CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2023-25823MEDIUMGradio contains Use of Hard-coded CredentialsEPSS 0.6%CVE-2023-48374MEDIUMSmartStar Software CWS Web-Base - Use of Hard-coded CredentialsEPSS 0.6%CVE-2025-2538CRITICALBUG-000174336EPSS 0.6%