CWE-201— Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog
508 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-201page 4 of 11
- CVE-2024-32825HIGHCVSS 7.5EG 7.52024-04-24
Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.
- CVE-2023-49261HIGHCVSS 7.5EG 7.52024-01-12
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CVE-2023-52190HIGHCVSS 7.5EG 7.52024-01-08
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.
- CVE-2020-8975HIGHCVSS 7.5EG 7.52022-10-17
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system.
- CVE-2016-10519HIGHCVSS 7.5EG 7.52018-05-31
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
- CVE-2016-10518HIGHCVSS 7.5EG 7.52018-05-31
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given paylo…
- CVE-2025-59578HIGHCVSS 5.8EG 7.52025-10-22
Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.
- CVE-2025-53218HIGHCVSS 5.8EG 7.52025-10-22
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.5.
- CVE-2025-63019HIGHCVSS 5.3EG 7.52026-01-22
Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content…
- CVE-2025-62109HIGHCVSS 5.3EG 7.52025-12-09
Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.
- CVE-2025-62895HIGHCVSS 5.3EG 7.52025-10-27
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.
- CVE-2025-47444HIGHCVSS 5.3EG 7.52025-08-12
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
- CVE-2025-68516HIGHCVSS 5.0EG 7.52025-12-24
Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.
- CVE-2025-62947HIGHCVSS 5.0EG 7.52025-10-27
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through <= 2.2.5.
- CVE-2025-68989HIGHCVSS 4.3EG 7.52025-12-30
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-exte…
- CVE-2026-101043HIGHCVSS 7.4EG 7.42026-09-27
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-…
- CVE-2026-54660HIGHCVSS 7.4EG 7.42026-07-29
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDo…
- CVE-2026-57736HIGHCVSS 7.4EG 7.42026-07-01
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.
- CVE-2026-54821HIGHCVSS 7.4EG 7.42026-06-25
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.
- CVE-2026-52698HIGHCVSS 7.4EG 7.42026-06-17
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
- CVE-2026-49082HIGHCVSS 7.4EG 7.42026-06-15
Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions.
- CVE-2026-42746HIGHCVSS 7.3EG 7.32026-05-27
Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitive Data.This issue affects Smart Online Order for Clover: from n/a through <= 1.6…
- CVE-2026-20151HIGHCVSS 7.3EG 7.32026-04-01
A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission…
- CVE-2024-6586HIGHCVSS 7.3EG 7.32024-08-30
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an…
- CVE-2026-39729HIGHCVSS 7.2EG 7.22026-10-06
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
- CVE-2026-1777HIGHCVSS 7.2EG 7.22026-02-02
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissi…
- CVE-2025-66304HIGHCVSS 7.2EG 7.22025-12-01
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially …
- CVE-2023-6916HIGHCVSS 7.2EG 7.22024-04-10
Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.
- CVE-2026-113459HIGHCVSS 7.1EG 7.12026-10-20
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key an…
- CVE-2025-8862HIGHCVSS 7.0EG 7.02025-08-11
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacte…
- CVE-2026-105877MEDIUMCVSS 6.9EG 6.92026-10-09
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
- CVE-2026-66666MEDIUMCVSS 6.9EG 6.92026-10-06
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.…
- CVE-2026-104399MEDIUMCVSS 6.9EG 6.92026-10-06
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
- CVE-2026-78374MEDIUMCVSS 6.9EG 6.92026-09-10
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captc…
- CVE-2026-78303MEDIUMCVSS 6.9EG 6.92026-09-10
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potent…
- CVE-2026-63481MEDIUMCVSS 6.9EG 6.92026-08-20
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth crede…
- CVE-2026-27868MEDIUMCVSS 6.9EG 6.92026-06-17
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via t…
- CVE-2025-64502MEDIUMCVSS 6.9EG 6.92025-11-10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning be…
- CVE-2026-87015MEDIUMCVSS 6.8EG 6.82026-09-09
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each extern…
- CVE-2026-65812MEDIUMCVSS 6.8EG 6.82026-09-08
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- CVE-2026-86497MEDIUMCVSS 6.8EG 6.82026-09-07
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
- CVE-2025-7708MEDIUMCVSS 6.8EG 6.82026-02-09
Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulation. This issue affects k12net: through 26072025.
- CVE-2024-4536MEDIUMCVSS 6.8EG 6.82024-05-07
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from …
- CVE-2026-114183MEDIUMCVSS 6.5EG 6.52026-11-03
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
- CVE-2026-115293MEDIUMCVSS 6.5EG 6.52026-11-03
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch…
- CVE-2026-115947MEDIUMCVSS 6.5EG 6.52026-10-30
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
- CVE-2026-115594MEDIUMCVSS 6.5EG 6.52026-10-26
Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42.
- CVE-2026-105777MEDIUMCVSS 6.5EG 6.52026-10-21
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal ser…
- CVE-2026-19541MEDIUMCVSS 6.5EG 6.52026-10-16
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permis…
- CVE-2026-110361MEDIUMCVSS 6.5EG 6.52026-10-15
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1.
Map vulnerabilities like CWE-201 to your infrastructure
EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →