CWE-538— Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.— MITRE CWE catalog
113 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-538page 3 of 3
- CVE-2025-57734MEDIUMCVSS 4.3EG 4.32025-08-20
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
- CVE-2025-8452MEDIUMCVSS 4.3EG 4.32025-08-12
By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the …
- CVE-2019-12623MEDIUMCVSS 4.3EG 4.32019-08-21
A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to perform file enumeration on an affected system. The vulne…
- CVE-2019-10320MEDIUMCVSS 4.3EG 4.32019-05-21
Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of file…
- CVE-2018-16970MEDIUMCVSS 4.3EG 4.32018-09-12
Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.
- CVE-2025-25586MEDIUMCVSS 4.2EG 4.22025-03-18
yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml.
- CVE-2021-32822MEDIUMCVSS 4.0EG 4.02021-08-16
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data w…
- CVE-2023-5937LOWCVSS 3.8EG 3.82024-05-15
On Windows systems, the Arc configuration files resulted to be world-readable. This can lead to information disclosure by local attackers, via exfiltration of sensitive data from configuration files.
- CVE-2026-80175LOWCVSS 3.3EG 3.32026-09-09
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged atta…
- CVE-2017-5387LOWCVSS 3.3EG 3.32018-06-11
The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refers to a file that does not exist if the source page is loaded locally. This vuln…
- CVE-2018-20932LOWCVSS 2.7EG 2.72019-08-01
cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).
- CVE-2026-25827LOWCVSS 2.3EG 2.32026-09-15
An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal …
- CVE-2026-29114LOWCVSS 2.3EG 2.32026-06-10
A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clie…
Map vulnerabilities like CWE-538 to your infrastructure
EchelonGraph correlates every CVE — across CWE-538 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →