Weaknesses of type CWE-798

943 results

Uso de credenciais hardcoded

Credenciais (senhas, chaves de API, tokens) embutidas no código-fonte ou binários da aplicação. O risco é que qualquer pessoa com acesso ao código ou arquivo compilado consegue extrair essas credenciais e abusar dos recursos protegidos, sem depender de quebra de senha ou ataque de força bruta.

Example

Um desenvolvedor coloca a senha do banco de dados como string literal dentro do código: `String connStr = "Server=db.empresa.com;Password=Admin123!";` Quando o código é compilado, a senha fica visível em ferramentas de análise binária ou se o repositório for exposto. Um atacante a encontra e acessa diretamente o banco.

How to mitigate

Armazene credenciais em variáveis de ambiente, secrets managers (como HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração protegidos fora do repositório. Nunca commite credenciais no Git; use .gitignore e ferramentas de scanning automático para evitar.

CVE-2025-55263HIGHHCL Aftermarket DPC is affected by Hardcoded Sensitive DataEPSS 0.2%CVE-2026-5065HIGHIBM Controller is affected by vulnerabilitiesEPSS 0.2%CVE-2025-26398MEDIUMSolarWinds Database Performance Analyzer Hard-coded Cryptographic Key VulnerabilityEPSS 0.2%CVE-2025-1143HIGHBillion Electric M120N - Use of Hard-coded CredentialsEPSS 0.2%CVE-2026-19412HIGHHardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S RouterEPSS 0.2%CVE-2025-54465MEDIUMHard-coded Credentials Vulnerability in ZKTeco WL20EPSS 0.2%CVE-2024-50593HIGHHardcoded Service PasswordEPSS 0.2%CVE-2026-20111MEDIUMCisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityEPSS 0.2%CVE-2025-23179MEDIUMRibbon Communications - CWE-798: Use of Hard-coded CredentialsEPSS 0.2%CVE-2025-32888HIGHAn issue was discovered on goTenna Mesh devices with app 5.5.3 and firmware 1.1.12. The verification token used for sending SMS through a goEPSS 0.2%CVE-2022-22560HIGHDell EMC PowerScale OneFS 8.1.x - 9.1.x contain hard coded credentials. This allows a local user with knowledge of the credentials to login EPSS 0.2%CVE-2025-32889HIGHAn issue was discovered on goTenna v1 devices with app 5.5.3 and firmware 0.25.5. The verification token used for sending SMS through a goTeEPSS 0.2%CVE-2025-13954CRITICALHard-coded cryptographic keys in EZCast Pro II DongleEPSS 0.2%CVE-2026-86555MEDIUMHardcoded Key Vulnerability in ZTE SmartLife APPEPSS 0.2%CVE-2025-34501HIGHShuffle Master Deck Mate 2 Hard-coded Credentials & Exposed ServicesEPSS 0.2%CVE-2024-57790MEDIUMIXON B.V. IXrouter IX2400 (Industrial Edge Gateway) v3.0 was discovered to contain hardcoded root credentials stored in the non-volatile flaEPSS 0.2%CVE-2025-33100MEDIUMIBM Concert Software information disclosureEPSS 0.2%CVE-2026-81640HIGHSoftish C6 Ear Camera and EarVision Android Application Use of Hard-coded CredentialsEPSS 0.2%CVE-2022-34449MEDIUM PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability. Authenticated admin users caEPSS 0.2%CVE-2026-65313HIGHUse of hard-coded VNC credentials in the engineering-workstation provisioningEPSS 0.2%