Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2022-27600MEDIUMQTS, QuTS hero, QuTScloudEPSS 0.6%CVE-2024-38648CRITICALA hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uEPSS 0.6%CVE-2025-40537HIGHSolarWinds Web Help Desk Hardcoded Credentials VulnerabilityEPSS 0.6%CVE-2025-8974MEDIUMlinlinjava litemall JSON Web Token JwtHelper.java hard-coded credentialsEPSS 0.6%CVE-2022-41399HIGHThe optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypEPSS 0.6%CVE-2022-41157HIGHERP solution Remote Code Execution VulnerabilityEPSS 0.6%CVE-2023-37857LOWPHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panelsEPSS 0.6%CVE-2024-39208CRITICALluci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.EPSS 0.6%CVE-2026-59769HIGHFA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, EPSS 0.6%CVE-2023-36817HIGHThe King's Temple Church website Leaked Stripe API Key in Public Code RepositoryEPSS 0.6%CVE-2026-79396CRITICALUse of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentiEPSS 0.6%CVE-2026-17360CRITICALMultiple Vulnerabilities in IBM API ConnectEPSS 0.6%CVE-2025-1242CRITICALAdministrative Credentials Can Be Extracted Through Gardyn API ResponsesEPSS 0.6%CVE-2023-48250HIGHThe vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded acEPSS 0.6%CVE-2024-51431HIGHLB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.EPSS 0.6%CVE-2023-32274HIGHEnphase Installer Toolkit Android App Use of Hard-coded CredentialsEPSS 0.6%CVE-2024-4996CRITICALHardcoded Password in Wapro ERP DesktopEPSS 0.6%CVE-2026-31928CRITICALDaktronics Controller Firmware Use of Hard-coded CredentialsEPSS 0.6%CVE-2023-43583MEDIUMCryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allowEPSS 0.6%CVE-2022-45425HIGHSome Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by expEPSS 0.6%