CWE-201— Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog

504 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-201page 2 of 11

CVE-2021-23019HIGHCVSS 7.8EG 7.8
2021-06-01
The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
CVE-2026-42997HIGHCVSS 7.7EG 7.7
2026-05-05
An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides a…
CVE-2026-42379HIGHCVSS 7.7EG 7.7
2026-04-27
Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.
CVE-2025-66035HIGHCVSS 7.7EG 7.7
2025-11-26
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in…
CVE-2025-9958HIGHCVSS 7.7EG 7.7
2025-09-26
An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1, that could have allowed Guest users to access sensitive information stored in virtual registry config…
CVE-2025-43768HIGHCVSS 7.7EG 7.7
2025-08-23
Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows authenticated users without a…
CVE-2024-23506HIGHCVSS 7.7EG 7.7
2024-01-27
Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.
CVE-2026-40161HIGHCVSS 6.5EG 7.7
2026-04-21
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the syst…
CVE-2024-7872HIGHCVSS 7.6EG 7.6
2025-03-06
Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data. This issue affects Extreme XDS: before 3933.
CVE-2023-28117HIGHCVSS 7.6EG 7.6
2023-03-22
Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies valu…
CVE-2026-116861HIGHCVSS 7.5EG 7.5
2026-10-30
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-118083HIGHCVSS 7.5EG 7.5
2026-10-29
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-115591HIGHCVSS 7.5EG 7.5
2026-10-28
Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5.
CVE-2026-86415HIGHCVSS 7.5EG 7.5
2026-10-20
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though th…
CVE-2026-109695HIGHCVSS 7.5EG 7.5
2026-10-15
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1.
CVE-2026-62043HIGHCVSS 7.5EG 7.5
2026-10-10
Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.
CVE-2026-42630HIGHCVSS 7.5EG 7.5
2026-10-10
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
CVE-2026-105071HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions.
CVE-2026-104385HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
CVE-2026-42413HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions.
CVE-2026-41562HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
CVE-2026-41561HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
CVE-2026-41559HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions.
CVE-2026-41563HIGHCVSS 7.5EG 7.5
2026-10-06
Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.
CVE-2026-103334HIGHCVSS 7.5EG 7.5
2026-10-05
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Res…
CVE-2026-97307HIGHCVSS 7.5EG 7.5
2026-10-04
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
CVE-2026-97241HIGHCVSS 7.5EG 7.5
2026-09-30
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
CVE-2026-97240HIGHCVSS 7.5EG 7.5
2026-09-30
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
CVE-2026-86450HIGHCVSS 7.5EG 7.5
2026-09-29
Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile …
CVE-2026-78336HIGHCVSS 7.5EG 7.5
2026-09-14
Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all …
CVE-2026-81804HIGHCVSS 7.5EG 7.5
2026-09-10
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions.
CVE-2026-80255HIGHCVSS 7.5EG 7.5
2026-09-06
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent ov…
CVE-2026-55553HIGHCVSS 7.5EG 7.5
2026-08-25
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origin…
CVE-2026-66585HIGHCVSS 7.5EG 7.5
2026-08-24
Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.
CVE-2026-75953HIGHCVSS 7.5EG 7.5
2026-08-19
Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to…
CVE-2026-73386HIGHCVSS 7.5EG 7.5
2026-08-19
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.
CVE-2026-73384HIGHCVSS 7.5EG 7.5
2026-08-19
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
CVE-2026-66463HIGHCVSS 7.5EG 7.5
2026-08-13
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
CVE-2026-66443HIGHCVSS 7.5EG 7.5
2026-08-13
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
CVE-2026-65543HIGHCVSS 7.5EG 7.5
2026-08-06
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
CVE-2026-66901HIGHCVSS 7.5EG 7.5
2026-08-04
Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hos…
CVE-2026-67322HIGHCVSS 7.5EG 7.5
2026-08-01
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before …
CVE-2026-13380HIGHCVSS 7.5EG 7.5
2026-07-20
VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within…
CVE-2026-7488HIGHCVSS 7.5EG 7.5
2026-07-17
Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026.
CVE-2026-7189HIGHCVSS 7.5EG 7.5
2026-07-17
Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0.
CVE-2026-54834HIGHCVSS 7.5EG 7.5
2026-06-26
Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.
CVE-2026-54841HIGHCVSS 7.5EG 7.5
2026-06-25
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
CVE-2026-34888HIGHCVSS 7.5EG 7.5
2026-06-17
Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.
CVE-2026-52692HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
CVE-2026-52695HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Map vulnerabilities like CWE-201 to your infrastructure

EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →