CWE-201— Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog

508 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-201page 6 of 11

CVE-2025-43825MEDIUMCVSS 6.5EG 6.5
2025-10-03
A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 throug…
CVE-2025-43814MEDIUMCVSS 6.5EG 6.5
2025-09-22
In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions the audit events records a user�…
CVE-2025-5519MEDIUMCVSS 6.5EG 6.5
2025-09-16
Insertion of Sensitive Information Into Sent Data vulnerability in ArgusTech BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.6.
CVE-2025-58872MEDIUMCVSS 6.5EG 6.5
2025-09-05
Insertion of Sensitive Information Into Sent Data vulnerability in premiumbizthemes Simple Price Calculator simple-price-calculator-basic allows Retrieve Embedded Sensitive Data.This issue affects Simple Price Calculator: from n/a through …
CVE-2025-55750MEDIUMCVSS 6.5EG 6.5
2025-08-29
Gitpod is a developer platform for cloud development environments. In versions before main-gha.33628 for both Gitpod Classic and Gitpod Classic Enterprise, OAuth integration with Bitbucket in certain conditions allowed a crafted link to ex…
CVE-2025-41415MEDIUMCVSS 6.5EG 6.5
2025-08-21
The vulnerability, if exploited, could allow an authenticated miscreant (with privileges to access publication targets) to retrieve sensitive information that could then be used to gain additional access to downstream resources.
CVE-2025-54008MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This issue affects JetSmartFilters: from n/a through <= 3.6.7.
CVE-2025-53998MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue affects JetWooBuilder: from n/a through <= 2.1.20.
CVE-2025-53993MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup jet-popup allows Retrieve Embedded Sensitive Data.This issue affects JetPopup: from n/a through <= 2.0.15.
CVE-2025-53992MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embedded Sensitive Data.This issue affects JetTricks: from n/a through <= 1.5.4.1.
CVE-2025-53988MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.
CVE-2025-53987MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded Sensitive Data.This issue affects JetMenu: from n/a through <= 2.4.11.1.
CVE-2025-53985MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTabs: from n/a through <= 2.2.9.
CVE-2025-53983MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements allows Retrieve Embedded Sensitive Data.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.
CVE-2025-53196MEDIUMCVSS 6.5EG 6.5
2025-08-20
Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.
CVE-2025-54685MEDIUMCVSS 6.5EG 6.5
2025-08-14
Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through <= 1.1.0.
CVE-2025-7204MEDIUMCVSS 6.5EG 6.5
2025-07-09
In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encry…
CVE-2025-27001MEDIUMCVSS 6.5EG 6.5
2025-03-28
Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Shipmondo – A …
CVE-2025-24567MEDIUMCVSS 6.5EG 6.5
2025-02-14
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
CVE-2025-24639MEDIUMCVSS 6.5EG 6.5
2025-02-03
Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.
CVE-2025-24597MEDIUMCVSS 6.5EG 6.5
2025-01-31
Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Retrieve Embedded Sensitive Data.This issue affe…
CVE-2024-54309MEDIUMCVSS 6.5EG 6.5
2024-12-13
Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through <= 1.0.4.
CVE-2024-5213MEDIUMCVSS 6.5EG 6.5
2024-06-20
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/u…
CVE-2024-35189MEDIUMCVSS 6.5EG 6.5
2024-05-30
Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private …
CVE-2024-26270MEDIUMCVSS 6.5EG 6.5
2024-02-20
The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s hashed password in the page’s HTML source, which allows man-in-the-middle att…
CVE-2023-49594MEDIUMCVSS 6.5EG 6.5
2023-12-23
An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging in…
CVE-2023-3413MEDIUMCVSS 6.5EG 6.5
2023-09-29
An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to read the source code of a proj…
CVE-2023-4002MEDIUMCVSS 6.5EG 6.5
2023-08-04
An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for EE-licensed users to link …
CVE-2023-25499MEDIUMCVSS 6.5EG 6.5
2023-06-22
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 t…
CVE-2023-1975MEDIUMCVSS 6.5EG 6.5
2023-04-11
Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.
CVE-2022-23488MEDIUMCVSS 6.5EG 6.5
2022-12-17
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows …
CVE-2022-27671MEDIUMCVSS 6.5EG 6.5
2022-04-12
A CSRF token visible in the URL may possibly lead to information disclosure vulnerability.
CVE-2020-27748MEDIUMCVSS 6.5EG 6.5
2021-06-01
A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send …
CVE-2019-15580MEDIUMCVSS 6.5EG 6.5
2019-12-18
An information exposure vulnerability exists in gitlab.com <v12.3.2, <v12.2.6, and <v12.1.10 when using the blocking merge request feature, it was possible for an unauthenticated user to see the head pipeline data of a public project even …
CVE-2017-2582MEDIUMCVSS 6.5EG 6.5
2018-07-26
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system pr…
CVE-2013-1840MEDIUMCVSS 6.5EG 6.5
2013-03-22
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, wh…
CVE-2024-50378MEDIUMCVSS 4.9EG 6.5
2024-11-08
Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those …
CVE-2026-10101MEDIUMCVSS 6.3EG 6.3
2026-05-29
ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view` ClusterRole cannot directly read Secrets, but ca…
CVE-2025-68029MEDIUMCVSS 6.3EG 6.3
2026-01-05
Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Wallet System for WooCommerce: from n/a thr…
CVE-2026-103957MEDIUMCVSS 6.2EG 6.2
2026-10-02
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests …
CVE-2025-47775MEDIUMCVSS 6.2EG 6.2
2025-05-14
Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.
CVE-2022-0018MEDIUMCVSS 6.1EG 6.1
2022-02-10
An information exposure vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows and MacOS where the credentials of the local user account are sent to the GlobalProtect portal when the Single Sign-On feature is enabled i…
CVE-2020-13597MEDIUMCVSS 6.0EG 6.0
2020-06-03
Clusters using Calico (version 3.14.0 and below), Calico Enterprise (version 2.8.2 and below), may be vulnerable to information disclosure if IPv6 is enabled but unused. A compromised pod with sufficient privilege is able to reconfigure th…
CVE-2026-121554MEDIUMCVSS 5.9EG 5.9
2026-11-03
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a requ…
CVE-2026-116689MEDIUMCVSS 5.9EG 5.9
2026-10-27
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaS…
CVE-2026-114190MEDIUMCVSS 5.9EG 5.9
2026-10-24
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9.
CVE-2026-66822MEDIUMCVSS 5.9EG 5.9
2026-10-13
Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-42419MEDIUMCVSS 5.9EG 5.9
2026-10-10
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.
CVE-2026-66435MEDIUMCVSS 5.9EG 5.9
2026-10-10
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.
CVE-2026-67354MEDIUMCVSS 5.9EG 5.9
2026-08-01
guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') fr…

Map vulnerabilities like CWE-201 to your infrastructure

EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →