CWE-201: Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- zozothemes corpkitWordPress Corpkit theme <= 1.0.5 - Sensitive Data Exposure vulnerability6.5 Medium
- hubspotWordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability7.4 High
- genua genucenterGenucenter Disclosure of SNMP Credentials4.3 Medium
- ibm devops deploy, ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more +3 moreIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerability6.5 Medium
- devolutions powershell universalInsertion of sensitive information into sent data in the AI Agent job API in Devolutions...6.5 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.0.11 - Sensitive Data Exposure vulnerability6.5 Medium
- fpuenteonline object cache 4 everyoneWordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability7.5 High
neotomanpmneotoma has tenant isolation gap in relationship query endpoints0.6 Low- pnpmpnpm: Repository config can expand victim environment secrets into registry requests before scripts run6.5 Medium
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.3 - Sensitive Data Exposure vulnerability8.3 High
- appsbd viteposWordPress Vitepos plugin <= 3.4.2 - Sensitive Data Exposure vulnerability7.5 High
- bootstrapped ventures visual link previewWordPress Visual Link Preview plugin <= 2.3.1 - Sensitive Data Exposure vulnerability7.4 High
- curltrailing dot domain super cookie9.1 Critical
- openidentityplatform openamOpenAM Session Hijacking via CDSSO8.3 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat6.7 Medium
- marketing fire widget optionsWordPress Widget Options plugin <= 4.0.1 - Subscriber+ User Meta Data Exposure Vulnerability6.5 Medium
- syed balkhi pushengage – web push notifications, ecommerce automation & chat widgetWordPress PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget plugin <= 4.2.3 - Sensitive Data Exposure vulnerability7.4 High
- bricksforgeWordPress Bricksforge plugin <= 3.1.8.4 - Sensitive Data Exposure vulnerability7.5 High
- teldat regesta smart hd-plc - tldph16d2PUBLICATION OF SENSITIVE INFORMATION ON REGESTA SMART HD-PLC OF TELDAT6.9 Medium
- roxnor getgenieWordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability6.5 Medium
- al monsor abc crypto checkoutWordPress ABC Crypto Checkout plugin <= 1.8.2 - Sensitive Data Exposure vulnerability7.5 High
- mra13 affiliates managerWordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerability7.5 High
- chatway live chat – ai chatbot, customer support, faq & helpdesk customer service & chat buttonsWordPress Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons plugin <= 1.4.8 - Sensitive Data Exposure vulnerability7.4 High
- watchful xclonerWordPress XCloner plugin <= 4.8.6 - Sensitive Data Exposure vulnerability6.5 Medium
- booklyWordPress Bookly plugin <= 27.4 - Sensitive Data Exposure vulnerability7.5 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability7.5 High
- ameliabooking ameliaWordPress Amelia plugin <= 2.2 - Sensitive Data Exposure vulnerability7.5 High
- inisev backup migrationWordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability7.5 High
- ayecode ltd getpaidWordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerability7.5 High
- mattermost, mattermost server +1 moreMattermost Remote Cluster PATCH API Leaks Authentication Tokens6.5 Medium
- dfir-iris iris-webIRIS has an Excessive Data Exposure issue6.5 Medium
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter8.2 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection7.5 High
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreEnvironment Variable Resolution Vulnerability in mlflow/mlflow9.1 Critical
- danny-avila librechatLibreChat Shared MCP Server View Leaks Decrypted Admin Secrets6.5 Medium
- namelessmc namelessNamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writes5.3 Medium
- logtivity activity logs, user activity tracking, multisite activity log from logtivityWordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests3.4 Low
- red hat multicluster engine for kubernetesAssisted-service: assisted-service: infraenv status leaks referenced pull-secret contents to namespace view users6.3 Medium
- frangoteam fuxaFUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations7.5 High
- zaytech smart online order for cloverWordPress Smart Online Order for Clover plugin <= 1.6.0 - Sensitive Data Exposure vulnerability7.3 High
- edge22 generateblocksWordPress GenerateBlocks plugin <= 2.1.0 - Sensitive Data Exposure vulnerability6.5 Medium
- open-metadata openmetadataOpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular users8.3 High
github.com/kong/kubernetes-ingress-controllerGo,github.com/kong/kubernetes-ingress-controller/v2Go,github.com/kong/kubernetes-ingress-controller/v3Go +2 moreKong Ingress Controller for Kubernetes (KIC): Secret-backed plugin configurations leak through non-sensitive diagnostics endpoint4.9 Medium- strawberry graphql, strawberry-graphql strawberry +1 moreStrawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs3.1 Low
- czlonkowski n8n-mcpn8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters6.5 Medium
- dbt-labs dbt-mcp, getdbt dbt mcp server +1 moredbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction3.1 Low
- hcl aionHCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions5.1 Medium
- hcl aionHCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed5.1 Medium
- hcl aionHCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields.2.6 Low
- Show moreLoading…