CWE-497— Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.— MITRE CWE catalog

452 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-497page 2 of 10

CVE-2026-81774HIGHCVSS 7.5EG 7.5
2026-09-02
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attac…
CVE-2026-78268HIGHCVSS 7.5EG 7.5
2026-08-24
Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions.
CVE-2026-32468HIGHCVSS 7.5EG 7.5
2026-08-18
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.
CVE-2024-58375HIGHCVSS 7.5EG 7.5
2026-08-16
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may…
CVE-2026-66462HIGHCVSS 7.5EG 7.5
2026-08-13
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
CVE-2026-59548HIGHCVSS 7.5EG 7.5
2026-07-27
Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions.
CVE-2026-59528HIGHCVSS 7.5EG 7.5
2026-07-27
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
CVE-2023-37507HIGHCVSS 7.5EG 7.5
2026-07-21
HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed.
CVE-2026-56124HIGHCVSS 7.5EG 7.5
2026-06-29
phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index mode…
CVE-2026-56060HIGHCVSS 7.5EG 7.5
2026-06-26
Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
CVE-2026-54824HIGHCVSS 7.5EG 7.5
2026-06-26
Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions.
CVE-2026-52694HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.
CVE-2026-49056HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.
CVE-2026-49066HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
CVE-2026-49068HIGHCVSS 7.5EG 7.5
2026-06-15
Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions.
CVE-2026-34891HIGHCVSS 7.5EG 7.5
2026-06-15
Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions.
CVE-2018-25358HIGHCVSS 7.5EG 7.5
2026-05-23
D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST requests. Attackers can send requests to /m…
CVE-2026-43654HIGHCVSS 7.5EG 7.5
2026-05-11
The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An a…
CVE-2025-15623HIGHCVSS 7.5EG 7.5
2026-04-17
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. Unauthenticated user can retri…
CVE-2025-13616HIGHCVSS 7.5EG 7.5
2026-03-03
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system.
CVE-2025-13651HIGHCVSS 7.5EG 7.5
2026-02-11
Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31.
CVE-2020-36922HIGHCVSS 7.5EG 7.5
2026-01-06
Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details through API endpoints. Attackers can retrieve network interface information, server…
CVE-2025-9110HIGHCVSS 7.5EG 7.5
2026-01-02
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application dat…
CVE-2025-64258HIGHCVSS 7.5EG 7.5
2025-12-18
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.This issue affects Follow My Blog Post: from n/a through <= 2…
CVE-2025-14712HIGHCVSS 7.5EG 7.5
2025-12-15
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
CVE-2025-36160HIGHCVSS 7.5EG 7.5
2025-11-20
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system.
CVE-2025-54459HIGHCVSS 7.5EG 7.5
2025-10-29
Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain live request traces and sensitive information such as request m…
CVE-2025-43024HIGHCVSS 7.5EG 7.5
2025-10-28
A GUI dialog of an application allows to view what files are in the file system without proper authorization.
CVE-2025-52616HIGHCVSS 7.5EG 7.5
2025-10-12
HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.
CVE-2025-58585HIGHCVSS 7.5EG 7.5
2025-10-06
Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.
CVE-2025-27721HIGHCVSS 7.5EG 7.5
2025-08-21
Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system resources.
CVE-2024-51770HIGHCVSS 7.5EG 7.5
2025-07-14
An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17.
CVE-2025-31045HIGHCVSS 7.5EG 7.5
2025-06-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows Retrieve Embedded Sensitive Data.This issue affects elfsight Contact Form widget…
CVE-2025-3606HIGHCVSS 7.5EG 7.5
2025-04-25
Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device.
CVE-2025-26730HIGHCVSS 7.5EG 7.5
2025-04-15
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue affects Macro Calculator with Admin Email Optin & Data: from n/a through 1.0.
CVE-2025-27934HIGHCVSS 7.5EG 7.5
2025-04-09
Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may obtain the product authentication information.
CVE-2024-8550HIGHCVSS 7.5EG 7.5
2025-02-10
A Local File Inclusion (LFI) vulnerability exists in the /load-workflow endpoint of modelscope/agentscope version v0.0.4. This vulnerability allows an attacker to read arbitrary files from the server, including sensitive files such as API …
CVE-2024-54279HIGHCVSS 7.5EG 7.5
2024-12-16
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tobias Keller WP-NERD Toolkit wp-nerd-toolkit.This issue affects WP-NERD Toolkit: from n/a through <= 1.1.
CVE-2024-50528HIGHCVSS 7.5EG 7.5
2024-11-04
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Retrieve Embedded Sensitive Data.This issue affects Stacks Mobile App Builder: fr…
CVE-2024-48024HIGHCVSS 7.5EG 7.5
2024-10-17
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily keep-backup-daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through <=…
CVE-2024-5735HIGHCVSS 7.5EG 7.5
2024-06-28
Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.
CVE-2024-36070HIGHCVSS 7.5EG 7.5
2024-05-19
tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. (An update is also available for the…
CVE-2024-31887HIGHCVSS 7.5EG 7.5
2024-04-16
IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651.
CVE-2024-22125HIGHCVSS 7.5EG 7.5
2024-01-09
Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confi…
CVE-2024-22124HIGHCVSS 7.5EG 7.5
2024-01-09
Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, …
CVE-2022-4366HIGHCVSS 7.5EG 7.5
2022-12-08
Missing Authorization in GitHub repository lirantal/daloradius prior to master branch.
CVE-2020-26076HIGHCVSS 7.5EG 7.5
2020-11-18
A vulnerability in Cisco IoT Field Network Director (FND) could allow an unauthenticated, remote attacker to view sensitive database information on an affected device. The vulnerability is due to the absence of authentication for sensitive…
CVE-2025-34442HIGHCVSS 6.9EG 7.5
2025-12-17
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective atta…
CVE-2026-24536HIGHCVSS 5.3EG 7.5
2026-01-23
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through <= 4.38.0.
CVE-2026-24523HIGHCVSS 5.3EG 7.5
2026-01-23
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through <…

Map vulnerabilities like CWE-497 to your infrastructure

EchelonGraph correlates every CVE — across CWE-497 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →