Fallos del tipo CWE-259

224 resultados

Senha hard-coded no código

Credenciais (usuário, senha, chave de API) embutidas diretamente no código-fonte ou binário da aplicação. O problema é que qualquer pessoa com acesso ao código (repositório, binário, decompilação) consegue extrair a credencial e acessar sistemas protegidos sem autenticação legítima.

Ejemplo

Um desenvolvedor escreve `db_password = 'admin123'` no arquivo de configuração versionado no Git, ou coloca uma chave AWS como string constante no código. Um atacante clona o repositório público, encontra a senha e acessa o banco de dados direto.

Cómo mitigar

Use variáveis de ambiente, secrets managers (HashiCorp Vault, AWS Secrets Manager) ou arquivos de configuração não versionados. Nunca versione credenciais; revise histórico do Git com ferramentas como `git-secrets` ou `TruffleHog` para credenciais já commitadas e as rotacione imediatamente.

CVE-2026-121609CRITICALQihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentialsEPSS 0.5%CVE-2026-93970MEDIUMaiyiyi121 SxDevOps Settings settings.py hard-coded credentialsEPSS 0.5%CVE-2026-93969MEDIUMaiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentialsEPSS 0.5%CVE-2026-90509MEDIUMdromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsEPSS 0.5%CVE-2026-7251CRITICALEppendorf BioFlo 320 Use of hard-coded passwordEPSS 0.5%CVE-2023-50948MEDIUMIBM Storage Fusion HCI information disclosureEPSS 0.5%CVE-2026-86276MEDIUMSourceCodester Syllabus-Aligned Learning Management & Examination System db.php hard-coded credentialsEPSS 0.5%CVE-2026-78062MEDIUMvas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentialsEPSS 0.5%CVE-2024-2038HIGHVisual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded CredentialsEPSS 0.5%CVE-2022-29825MEDIUMUse of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) veEPSS 0.5%CVE-2025-44955HIGHRUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password.EPSS 0.5%CVE-2020-12037—Baxter PrismaFlex all versions, PrisMax all versions prior to 3.x, The affected devices do not implement data-in-transit encryption (e.g., TEPSS 0.5%CVE-2026-86673MEDIUMningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentialsEPSS 0.5%CVE-2024-37644HIGHTRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackerEPSS 0.5%CVE-2026-82808MEDIUMInbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentialsEPSS 0.5%CVE-2024-28066HIGHIn Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).EPSS 0.4%CVE-2025-30115CRITICALAn issue was discovered on the Forvia Hella HELLA Driving Recorder DR 820. Default Credentials Cannot Be Changed. It uses a fixed default SSEPSS 0.4%CVE-2024-7216LOWTOTOLINK LR1200 shadow.sample hard-coded passwordEPSS 0.4%CVE-2026-112146MEDIUMD-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentialsEPSS 0.4%CVE-2024-35395HIGHTOTOLINK CP900L v4.1.5cu.798_B20221228 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attaEPSS 0.4%