Falhas do tipo CWE-259

222 resultados

Senha codificada no código-fonte

É quando credenciais (senhas, tokens, chaves de API) são gravadas diretamente no código-fonte ou em arquivos de configuração versionados. Qualquer pessoa com acesso ao repositório, imagem Docker ou executável consegue extrair a credencial, comprometendo contas e serviços.

Exemplo

Um desenvolvedor escreve `const dbPassword = 'admin123'` no arquivo de conexão ou coloca `API_KEY=sk-1234abcd` em um arquivo .env enviado ao Git. Quando o repositório é clonado ou a imagem é construída, a credencial vira legível para todos.

Como mitigar

Use variáveis de ambiente, gerenciadores de secrets (Vault, AWS Secrets Manager, Azure Key Vault) ou arquivos de configuração local não versionados (.env.local). Nunca commite credenciais; implemente scanning de repositórios e revogue qualquer chave exposta.

CVE-2025-5379MEDIUMNuCom NC-WR744G Console Application hard-coded credentialsEPSS 0.3%CVE-2025-2556MEDIUMAudi UTR Dashcam Video Stream hard-coded credentialsEPSS 0.3%CVE-2026-7579MEDIUMAstrBotDevs AstrBot Dashboard auth.py hard-coded credentialsEPSS 0.3%CVE-2026-11552MEDIUMSourceCodester Onlne Examination & Learning Management System import_users.php hard-coded passwordEPSS 0.3%CVE-2025-11643MEDIUMTomofun Furbo 360/Furbo Mini MQTT Client Certificate furbo_img hard-coded credentialsEPSS 0.3%CVE-2026-6574MEDIUMosuuu LightPicture API Upload Endpoint lp.sql hard-coded credentialsEPSS 0.3%CVE-2026-8032MEDIUMPicoTronica e-Clinic Healthcare System ECHS echs.js hard-coded credentialsEPSS 0.3%CVE-2024-2197LOWChirp Systems Chirp Access Use of Hard-coded PasswordEPSS 0.3%CVE-2026-2702LOWBeetel 777VR1 WPA2 PSK hard-coded credentialsEPSS 0.3%CVE-2026-101052MEDIUMrefly-ai refly JWT Token app.config.ts hard-coded credentialsEPSS 0.3%CVE-2025-30106HIGHOn IROAD v9 devices, the dashcam has hardcoded default credentials ("qwertyuiop") that cannot be changed by the user. This allows an attackeEPSS 0.3%CVE-2026-105147MEDIUMSciPhi-AI R2R JWT Secret hard-coded credentialsEPSS 0.3%CVE-2024-39585HIGHDell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. EPSS 0.3%CVE-2026-97877MEDIUMzhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded passwordEPSS 0.3%CVE-2025-61330MEDIUMA hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C. TEPSS 0.3%CVE-2026-11515MEDIUMSourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordEPSS 0.3%CVE-2026-6610MEDIUMliangliangyy DjangoBlog Setting settings.py hard-coded credentialsEPSS 0.3%CVE-2025-7564HIGHLB-LINK BL-AC3600 shadow hard-coded credentialsEPSS 0.3%CVE-2021-27452—The software contains a hard-coded password that could allow an attacker to take control of the merging unit using these hard-coded credentiEPSS 0.3%CVE-2022-26388MEDIUMUse of Hard-Coded Password Vulnerability in ELI Electrocardiograph DevicesEPSS 0.3%