CWE-201— Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog

508 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-201page 9 of 11

CVE-2025-48996MEDIUMCVSS 5.3EG 5.3
2025-06-02
HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management …
CVE-2025-39498MEDIUMCVSS 5.3EG 5.3
2025-05-26
Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7…
CVE-2025-31842MEDIUMCVSS 5.3EG 5.3
2025-04-01
Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Sensitive Data.This issue affects Viral Loops WP Integration: from n/a through <= …
CVE-2025-30609MEDIUMCVSS 5.3EG 5.3
2025-03-24
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.3.
CVE-2023-38013MEDIUMCVSS 5.3EG 5.3
2025-01-25
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the …
CVE-2025-24582MEDIUMCVSS 5.3EG 5.3
2025-01-24
Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.
CVE-2024-13269MEDIUMCVSS 5.3EG 5.3
2025-01-09
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.
CVE-2025-22303MEDIUMCVSS 5.3EG 5.3
2025-01-07
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.17.0.
CVE-2024-6747MEDIUMCVSS 5.3EG 5.3
2024-10-10
Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data
CVE-2024-43264MEDIUMCVSS 5.3EG 5.3
2024-08-26
Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine: from n/a through <= 1.9.8.
CVE-2024-43259MEDIUMCVSS 5.3EG 5.3
2024-08-26
Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue affects Order Export for WooCommerce: from n/a through <= 3.23.
CVE-2024-43230MEDIUMCVSS 5.3EG 5.3
2024-08-26
Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.28.
CVE-2024-43283MEDIUMCVSS 5.3EG 5.3
2024-08-26
Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 23.1.2.
CVE-2024-37270MEDIUMCVSS 5.3EG 5.3
2024-07-10
Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
CVE-2024-37881MEDIUMCVSS 5.3EG 5.3
2024-06-19
SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a mea…
CVE-2024-34812MEDIUMCVSS 5.3EG 5.3
2024-05-14
Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through <= 2.…
CVE-2024-34556MEDIUMCVSS 5.3EG 5.3
2024-05-14
Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode…
CVE-2024-1435MEDIUMCVSS 5.3EG 5.3
2024-02-29
Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.6.
CVE-2023-3949MEDIUMCVSS 5.3EG 5.3
2023-12-01
An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a …
CVE-2023-5831MEDIUMCVSS 5.3EG 5.3
2023-11-06
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the `super_sidebar_logged_o…
CVE-2023-3102MEDIUMCVSS 5.3EG 5.3
2023-07-21
A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR.
CVE-2023-34968MEDIUMCVSS 5.3EG 5.3
2023-07-20
A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client o…
CVE-2022-27779MEDIUMCVSS 5.3EG 5.3
2022-06-02
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](htt…
CVE-2021-1129MEDIUMCVSS 5.3EG 5.3
2021-01-20
A vulnerability in the authentication for the general purpose APIs implementation of Cisco Email Security Appliance (ESA), Cisco Content Security Management Appliance (SMA), and Cisco Web Security Appliance (WSA) could allow an unauthentic…
CVE-2020-25703MEDIUMCVSS 5.3EG 5.3
2020-11-19
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.…
CVE-2020-5364MEDIUMCVSS 5.3EG 5.3
2020-05-20
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain an SNMPv2 vulnerability. The SNMPv2 services is enabled, by default, with a pre-configured community string. This community string allows read-only access to many aspects of the Isil…
CVE-2026-82837MEDIUMCVSS 4.3EG 5.3
2026-09-15
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials an…
CVE-2025-62308MEDIUMCVSS 5.1EG 5.1
2026-05-14
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further…
CVE-2025-62305MEDIUMCVSS 5.1EG 5.1
2026-05-14
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems u…
CVE-2025-65944MEDIUMCVSS 5.1EG 5.1
2025-11-25
Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP heade…
CVE-2025-62998MEDIUMCVSS 5.0EG 5.0
2025-12-18
Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.
CVE-2025-20348MEDIUMCVSS 5.0EG 5.0
2025-08-27
A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to view sensitive information or upload and modify files on…
CVE-2023-1401MEDIUMCVSS 5.0EG 5.0
2023-07-26
An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.
CVE-2026-19601MEDIUMCVSS 4.9EG 4.9
2026-10-16
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a Syste…
CVE-2026-59809MEDIUMCVSS 4.9EG 4.9
2026-08-22
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL conta…
CVE-2025-15329MEDIUMCVSS 4.9EG 4.9
2026-02-05
Tanium addressed an information disclosure vulnerability in Threat Response.
CVE-2020-1774MEDIUMCVSS 4.5EG 4.9
2020-04-28
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS))…
CVE-2025-64299MEDIUMCVSS 2.7EG 4.9
2025-11-21
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.
CVE-2025-31978MEDIUMCVSS 4.3EG 4.6
2026-05-06
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt…
CVE-2026-20484MEDIUMCVSS 4.4EG 4.4
2026-08-03
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploi…
CVE-2025-20789MEDIUMCVSS 4.4EG 4.4
2025-12-02
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: A…
CVE-2026-107268MEDIUMCVSS 4.3EG 4.3
2026-10-30
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from…
CVE-2026-114485MEDIUMCVSS 4.3EG 4.3
2026-10-22
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via th…
CVE-2026-19603MEDIUMCVSS 4.3EG 4.3
2026-10-16
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID o…
CVE-2026-89203MEDIUMCVSS 4.3EG 4.3
2026-10-13
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for thei…
CVE-2026-104402MEDIUMCVSS 4.3EG 4.3
2026-10-04
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
CVE-2026-100258MEDIUMCVSS 4.3EG 4.3
2026-09-30
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVE-2026-66696MEDIUMCVSS 4.3EG 4.3
2026-08-06
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-28144MEDIUMCVSS 4.3EG 4.3
2026-07-31
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.
CVE-2026-44970MEDIUMCVSS 4.3EG 4.3
2026-07-16
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent …

Map vulnerabilities like CWE-201 to your infrastructure

EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →