CWE-532— Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.— MITRE CWE catalog

1,354 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-532page 19 of 28

CVE-2026-73457MEDIUMCVSS 5.3EG 5.3
2026-09-16
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticate…
CVE-2026-19363MEDIUMCVSS 5.3EG 5.3
2026-08-09
A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorizer. The manipulation results in sensitive information in log files. The attack ca…
CVE-2026-65311MEDIUMCVSS 5.3EG 5.3
2026-07-31
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attac…
CVE-2026-54236MEDIUMCVSS 5.3EG 5.3
2026-06-17
vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they r…
CVE-2026-45040MEDIUMCVSS 5.3EG 5.3
2026-05-28
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with RUST_LOG=debug sensitive credentials including SessionToken (…
CVE-2026-8200MEDIUMCVSS 5.3EG 5.3
2026-05-13
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 version…
CVE-2026-41495MEDIUMCVSS 5.3EG 5.3
2026-05-08
n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs in HTTP transport mode, incoming requests to the POST /mcp endpoint had their re…
CVE-2026-41182MEDIUMCVSS 5.3EG 5.3
2026-04-23
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_out…
CVE-2026-33558MEDIUMCVSS 5.3EG 5.3
2026-04-20
Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire requests and responses information in the DEBUG log level in the logs. By default, the log level is set to INFO level. …
CVE-2025-70040MEDIUMCVSS 5.3EG 5.3
2026-03-09
An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to obtain sensitive information.
CVE-2026-1265MEDIUMCVSS 5.3EG 5.3
2026-03-03
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file.
CVE-2026-2605MEDIUMCVSS 5.3EG 5.3
2026-02-20
Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
CVE-2025-13611MEDIUMCVSS 5.3EG 5.3
2025-11-26
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific condit…
CVE-2025-58189MEDIUMCVSS 5.3EG 5.3
2025-10-29
When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped.
CVE-2025-10486MEDIUMCVSS 5.3EG 5.3
2025-10-15
The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentiall…
CVE-2025-10645MEDIUMCVSS 5.3EG 5.3
2025-10-07
The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated…
CVE-2025-9985MEDIUMCVSS 5.3EG 5.3
2025-09-26
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to…
CVE-2025-31788MEDIUMCVSS 5.3EG 5.3
2025-04-01
Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-performance-accelerator allows Retrieve Embedded Sensitive Data.This issue affects…
CVE-2024-13818MEDIUMCVSS 5.3EG 5.3
2025-02-21
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and in…
CVE-2024-10544MEDIUMCVSS 5.3EG 5.3
2024-10-31
The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view p…
CVE-2024-9621MEDIUMCVSS 5.3EG 5.3
2024-10-08
A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logg…
CVE-2024-47913MEDIUMCVSS 5.3EG 5.3
2024-10-04
An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not auth…
CVE-2024-43990MEDIUMCVSS 5.3EG 5.3
2024-09-25
Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.
CVE-2024-37930MEDIUMCVSS 5.3EG 5.3
2024-08-12
Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0.
CVE-2024-38321MEDIUMCVSS 5.3EG 5.3
2024-08-03
IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could be read by an authenticated user. IBM X-Force ID: 284868.
CVE-2024-42349MEDIUMCVSS 5.3EG 5.3
2024-08-02
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of …
CVE-2024-6687MEDIUMCVSS 5.3EG 5.3
2024-08-01
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly acc…
CVE-2024-40636MEDIUMCVSS 5.3EG 5.3
2024-07-17
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, …
CVE-2024-37270MEDIUMCVSS 5.3EG 5.3
2024-07-10
Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
CVE-2024-37205MEDIUMCVSS 5.3EG 5.3
2024-07-10
Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4.
CVE-2024-22276MEDIUMCVSS 5.3EG 5.3
2024-06-27
VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjacent access to web/proxy server logging may be able to obtain sensitive information from URLs that …
CVE-2022-44587MEDIUMCVSS 5.3EG 5.3
2024-06-21
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
CVE-2024-32811MEDIUMCVSS 5.3EG 5.3
2024-06-09
Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.
CVE-2024-34798MEDIUMCVSS 5.3EG 5.3
2024-06-03
Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a through 1.4.5.
CVE-2024-34550MEDIUMCVSS 5.3EG 5.3
2024-05-14
Insertion of Sensitive Information into Log File vulnerability in AlexaCRM Dynamics 365 Integration.This issue affects Dynamics 365 Integration: from n/a through 1.3.17.
CVE-2024-33922MEDIUMCVSS 5.3EG 5.3
2024-05-02
Insertion of Sensitive Information into Log File vulnerability in Jordy Meow WP Media Cleaner.This issue affects WP Media Cleaner: from n/a through 6.7.2.
CVE-2024-32788MEDIUMCVSS 5.3EG 5.3
2024-04-24
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through 4.20.2.
CVE-2024-32686MEDIUMCVSS 5.3EG 5.3
2024-04-18
Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
CVE-2024-32513MEDIUMCVSS 5.3EG 5.3
2024-04-17
Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.
CVE-2024-31353MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2024-31298MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
CVE-2024-31247MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.
CVE-2024-2302MEDIUMCVSS 5.3EG 5.3
2024-04-09
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possib…
CVE-2024-30523MEDIUMCVSS 5.3EG 5.3
2024-03-31
Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.
CVE-2024-30514MEDIUMCVSS 5.3EG 5.3
2024-03-29
Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.
CVE-2024-30511MEDIUMCVSS 5.3EG 5.3
2024-03-29
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.
CVE-2024-25923MEDIUMCVSS 5.3EG 5.3
2024-03-28
Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.
CVE-2024-22138MEDIUMCVSS 5.3EG 5.3
2024-03-28
Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: from n/a through 2.20.47.
CVE-2023-50740MEDIUMCVSS 5.3EG 5.3
2024-03-06
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0
CVE-2024-23686MEDIUMCVSS 5.3EG 5.3
2024-01-19
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

Map vulnerabilities like CWE-532 to your infrastructure

EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →