Weaknesses of type CWE-798

943 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-4378CRITICALHardcoded Credentials in Ataturk University's ATA-AOF Mobile ApplicationEPSS 0.3%CVE-2026-81440HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticatedEPSS 0.3%CVE-2020-27256—In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a hard-coded physician PIN in the physician menu of the insulin pump aEPSS 0.3%CVE-2018-8857—Philips Brilliance CT software (Brilliance 64 version 2.6.2 and prior, Brilliance iCT versions 4.1.6 and prior, Brillance iCT SP versions 3.EPSS 0.3%CVE-2024-29960MEDIUMIdentical SSH keys utilized inside the OVA image (CVE-2024-29960)EPSS 0.3%CVE-2025-5751MEDIUMWOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 0.3%CVE-2017-12709—A Use of Hard-Coded Credentials issue was discovered in MRD-305-DIN versions older than 1.7.5.0, and MRD-315, MRD-355, MRD-455 versions oldeEPSS 0.3%CVE-2026-74892HIGHopenssl_encrypt before 1.4.0 Hardcoded Secret KeyEPSS 0.3%CVE-2024-1344MEDIUMEncrypted database credentials in LaborOfficeFreeEPSS 0.3%CVE-2026-48241CRITICALOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in loader.phpEPSS 0.3%CVE-2023-3262MEDIUMThe Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internalEPSS 0.3%CVE-2026-52539CRITICALOutstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application fEPSS 0.3%CVE-2024-48539CRITICALNeye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism.EPSS 0.3%CVE-2026-36538HIGHNetis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account iEPSS 0.3%CVE-2017-12317—The Cisco AMP For Endpoints application allows an authenticated, local attacker to access a static key value stored in the local applicationEPSS 0.3%CVE-2021-35232MEDIUMHard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate QueriesEPSS 0.3%CVE-2026-42372HIGHD-Link DIR-605L A1 Hardcoded Telnet Backdoor CredentialsEPSS 0.3%CVE-2026-4475HIGHYi Technology YI Home Camera ipc hard-coded credentialsEPSS 0.3%CVE-2024-28812HIGHAn issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) with hardcoded credenEPSS 0.3%CVE-2026-48242CRITICALOpen ISES Tickets < 3.44.2 Hardcoded MySQL Database Credentials in import_mdb.phpEPSS 0.3%