CWE-200: Information Disclosure
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Also known as Exposure of Sensitive Information to an Unauthorized Actor, Information Leak.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- coderCoder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint5.3 Medium
- coderCoder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest4.8 Medium
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha before 4.2.0-beta Information Disclosure via open-questions API6.9 Medium
- blair williams thirstyaffiliatesThirstyAffiliates < 3.12.1 - Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection6.5 Medium
- peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi), unknown peachpay — payments & express checkout for woocommerce (supports stripe, paypal, square, authorize.net, nmi) +1 morePeachPay 1.117.9 - 1.120.69 - Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check5.3 Medium
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter3.7 Low
- getarcaneapp arcaneArcane: Container-registry credential exfiltration via URL repoint + test to attacker host8.5 High
- apache software foundation kylinApache Kylin: Broken Access Control in QuerySQLBlacklistController7.5 High
- apache software foundation kylinApache Kylin: JobController allows unauthorized cross-project manipulation7.5 High
- apache software foundation kylinApache Kylin: Unauthorized cross-project job discard7.5 High
- apache software foundation kylinApache Kylin: Unauthorized SQL execution to Spark SQL env7.5 High
- mz automation libiec61850libIEC61850: Remote information disclosure in MMS file service via out-of-range initialPosition in fileOpen followed by fileRead7.5 High
- discourse discourse-doc-categoriesDiscourse Doc Categories: Doc category index refresh leaks private topic titles4.3 Medium
- open-zaakOpen Zaak: Path traversal / arbitrary server-file read via Documenten API document import (bestandspad)6.8 Medium
- apache software foundation kylinApache Kylin: Low-Privilege Config Exposure7.5 High
- unknown maioMAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key5.3 Medium
- mattermost, mattermost server +1 moreMattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads6.5 Medium
- smub wp mail loggingWP Mail Logging <= 1.17.0 - Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email2.7 Low
- realmag777 husky – products filter for woocommerce professionalHUSKY <= 1.4.5 - Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script5.3 Medium
- unknown product delivery date for woocommerceProduct Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions2.7 Low
- dimitri grassi salon booking systemSalon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming4.3 Medium
- dan rossiter document galleryDocument Gallery <= 5.1.1 - Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons5.3 Medium
- unknown visual form builderVisual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget4.3 Medium
- unknown coinsnap bitcoin crowdfundingCoinsnap Bitcoin Crowdfunding <= 1.2.0 - Unauthenticated Payment Record Forgery via Webhook Secret Disclosure5.3 Medium
- markjaquith subscribe to commentsSubscribe to Comments < 2.3.3 - Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie6.5 Medium
- extendthemes image hub – free images from unsplash, pixabay, pexels, openverse & giphyImage Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML4.3 Medium
- No product listedZ.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers...7.8 High
- No product listedDirectory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to...6.5 Medium
- gitpython-developers gitpythonGitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name8.7 High
- gitpython-developers gitpythonGitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name7.1 High
- itsmeravitejak online-examination-systemitsmeravitejak Online-Examination-System dbtables.sql information disclosure6.9 Medium
- error311 fileriseFileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php5.3 Medium
- error311 fileriseFileRise: Missing Authentication Guard on File Snippet Preview Endpoint3.7 Low
- labredescefetrj wegiaWeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php8.1 High
- dbt-labs dbt-coredbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`8.2 High
- gnome evolution-data-server, red hat enterprise linux 10, enterprise linux 6 +3 more +5 moreEvolution-data-server: local file disclosure via attach file:// uris5.7 Medium
- fogprojectFOG adInfo endpoint is reported to disclose the Active Directory join password7.5 High
- discourseDiscourse: Media uploads remain publicly accessible after category permissions are restricted7.5 High
- veracryptVeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt3.3 Low
- giteaGitea hidden-owner repository listing disclosure5.3 Medium
- giteaGitea restricted-user organization metadata disclosure4.3 Medium
- rustlsrustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure4.6 Medium
- copart copart’s online billing serviceUnauthorised disclosure of information on Copart’s online billing service9.2 Critical
- curlAuthorization: Negotiate sent to foreign origin9.1 Critical
- latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpressAppointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion4.3 Medium
- strategy11team awp classifiedsAWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page5.3 Medium
- tainacanTainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints4.3 Medium
- ruben garcia gamipressGamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure5.3 Medium
- passionate programmer peter wp data accessWP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export5.3 Medium
- unknown codeatoz b2b suite for woocommerceCodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure5.3 Medium
- Show moreLoading…