Weaknesses of type CWE-798

1,006 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-58659MEDIUMWordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-58656MEDIUMWordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2021-32993HIGHPhilips IntelliBridge EC 40 and EC 80 Hub Use of Hard-coded CredentialsEPSS 0.3%CVE-2026-119736HIGHAttendo Admin Android 3.0.13 Hard-coded MQTT Broker CredentialsEPSS 0.3%CVE-2026-87950MEDIUMSAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148EPSS 0.3%CVE-2026-7579MEDIUMAstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsEPSS 0.3%CVE-2025-1029HIGHHardcoded Credentials in Utarit Informatics' SoliClubEPSS 0.3%CVE-2026-33893HIGHA vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2406.0012), TeamcenteEPSS 0.3%CVE-2026-58245LOWHard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning)EPSS 0.3%CVE-2025-36087HIGHIBM Security Verify Access hard coded credentialsEPSS 0.3%CVE-2021-34577MEDIUMHardcoded credentials in Kaden PICOFLUX AiREPSS 0.3%CVE-2024-27168HIGHHardcoded keys used to generate authentication cookiesEPSS 0.3%CVE-2026-6574MEDIUMosuuu LightPicture API Upload Endpoint lp.sql hard-coded credentialsEPSS 0.3%CVE-2025-11643MEDIUMTomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentialsEPSS 0.3%CVE-2026-8032MEDIUMPicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentialsEPSS 0.3%CVE-2026-29128HIGHIDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable FilesEPSS 0.3%CVE-2026-23781CRITICALAn issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext withinEPSS 0.3%CVE-2025-6982MEDIUMHardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5EPSS 0.3%CVE-2020-27278—In Hamilton Medical AG,T1-Ventillator versions 2.2.3 and prior, hard-coded credentials in the ventilator allow attackers with physical accesEPSS 0.3%CVE-2026-29023MEDIUMKeygraph Shannon Hard-coded Router API KeyEPSS 0.3%