Weaknesses of type CWE-798

943 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-13252MEDIUMshsuishang ShopSuite ModulithShop RSA/OAuth2/Database hard-coded credentialsEPSS 0.3%CVE-2026-77847HIGHTycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded CredentialsEPSS 0.3%CVE-2019-5139MEDIUMAn exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. ThEPSS 0.3%CVE-2026-6578MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2023-49223HIGHPrecor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is storEPSS 0.3%CVE-2019-1919HIGHCisco FindIT Network Management Software Static Credentials VulnerabilityEPSS 0.3%CVE-2017-20214CRITICALFLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 Hard-Coded SSH Credentials VulnerabilityEPSS 0.3%CVE-2021-47744CRITICALCypress Solutions CTM-200/CTM-ONE 1.3.6 Hard-coded Credentials Remote RootEPSS 0.3%CVE-2026-22900MEDIUMQuNetSwitchEPSS 0.3%CVE-2025-36752CRITICALUndocumented backup Account and No Password Configuration CapabilityEPSS 0.3%CVE-2025-36747CRITICALHardcoded FTP Credentials within the firmwareEPSS 0.3%CVE-2022-38069MEDIUMContec Health CMS8000EPSS 0.3%CVE-2025-9497MEDIUMHardcoded Upgrade Decryption PasswordsEPSS 0.3%CVE-2024-49806CRITICALIBM Security Verify Access Appliance hard coded credentialsEPSS 0.3%CVE-2023-49222HIGHPrecor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to EPSS 0.3%CVE-2024-1661LOWTotolink X6000R shadow hard-coded credentialsEPSS 0.3%CVE-2026-47847MEDIUMBitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in the Galera replicatioEPSS 0.3%CVE-2025-66454MEDIUMArcade MCP Default Hardcoded Worker Secret Allows Full Unauthorized Access to All HTTP MCP Worker EndpointsEPSS 0.3%CVE-2025-4378CRITICALHardcoded Credentials in Ataturk University's ATA-AOF Mobile ApplicationEPSS 0.3%CVE-2023-28897MEDIUMHard-coded password for UDS servicesEPSS 0.3%