Weaknesses of type CWE-798

1,013 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-9497MEDIUMHardcoded Upgrade Decryption PasswordsEPSS 0.3%CVE-2020-37092CRITICALNetis E1+ 1.2.32533 - Backdoor Account (root)EPSS 0.3%CVE-2026-66890CRITICALUse of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product LineupsEPSS 0.3%CVE-2025-36572MEDIUMDell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image file. A low privilegeEPSS 0.3%CVE-2026-76131MEDIUMUse of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain EPSS 0.3%CVE-2026-77960MEDIUMUse of Hard-coded Credentials in Bransys ELDEPSS 0.3%CVE-2019-5139MEDIUMAn exploitable use of hard-coded credentials vulnerability exists in multiple iw_* utilities of the Moxa AWK-3131A firmware version 1.13. ThEPSS 0.3%CVE-2025-5751MEDIUMWOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass VulnerabilityEPSS 0.3%CVE-2021-35232MEDIUMHard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate QueriesEPSS 0.3%CVE-2026-6578MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2023-49223HIGHPrecor touchscreen console P62, P80, and P82 could allow a remote attacker to obtain sensitive information because the root password is storEPSS 0.3%CVE-2019-1919HIGHCisco FindIT Network Management Software Static Credentials VulnerabilityEPSS 0.3%CVE-2025-4378CRITICALHardcoded Credentials in Ataturk University's ATA-AOF Mobile ApplicationEPSS 0.3%CVE-2025-15628HIGHHardcoded Certificates in TP-Link Omada Device CommunicationsEPSS 0.3%CVE-2026-36538HIGHNetis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account iEPSS 0.3%CVE-2025-36747CRITICALHardcoded FTP Credentials within the firmwareEPSS 0.3%CVE-2025-36752CRITICALUndocumented backup Account and No Password Configuration CapabilityEPSS 0.3%CVE-2024-49806CRITICALIBM Security Verify Access Appliance hard coded credentialsEPSS 0.3%CVE-2023-49222HIGHPrecor touchscreen console P82 contains a private SSH key that corresponds to a default public key. A remote attacker could exploit this to EPSS 0.3%CVE-2024-1661LOWTotolink X6000R shadow hard-coded credentialsEPSS 0.3%