CWE-201: Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- kevin pirnie kp agent readyWordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability5.3 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Webhook Secret Disclosure via Capability Read API6.0 Medium
- curldomain-scoped PSL domain cookie8.2 High
- curlsecure cookie attribute bypass with tab7.5 High
- pnpmpnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings8.3 High
- ukr solution print barcode labels for your woocommerce products/ordersWordPress Print Barcode Labels for your WooCommerce products/orders plugin <= 4.0.0 - Sensitive Data Exposure vulnerability6.5 Medium
- drupal dxpr builder: the best editing (ai) experience for drupal, dxpr builder project builder +1 moreDXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-1125.3 Medium
- node-modules urlliburllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage7.5 High
- themewinter wp cafe proWordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability7.5 High
- siyuan-note siyuanSiYuan before v3.8.0 Secret Exfiltration via http_request URL6.9 Medium
- orange-opensource hurlHurl: Cookies in Cookies section leak when redirecting to a different host6.9 Medium
- cmsjunkie.com j-businessdirectory extension for joomlaJoomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.37.5 High
- zealousweb track geolocation of users using contact form 7WordPress Track Geolocation Of Users Using Contact Form 7 plugin <= 3.0.2 - Sensitive Data Exposure vulnerability7.5 High
- cmsminds pay with contact form 7WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability7.5 High
- averta shortcodes and extra features for phlox themeWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.24 - Sensitive Data Exposure vulnerability5.3 Medium
- hassan fakih icarryWordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability7.5 High
- pete nelson rest api logWordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability7.5 High
- arraytics wp event solutionWordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability6.5 Medium
- opendap inc. hyrax-dockerOPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects6.5 Medium
- cliGitHub CLI: Partial token disclosure in `gh auth status` output3.3 Low
- kadence wp gutenberg blocks by kadence blocksWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability4.3 Medium
- alex featured video plusWordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability5.3 Medium
- akshay menariya export import menusWordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability5.3 Medium
- wp zone custom css and javascriptWordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability5.3 Medium
- vimeodev vimeoWordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability7.5 High
- cjcollier google::authGoogle::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON7.5 High
- mediatek mt6739 firmware, mt6761 firmware, mt6765 firmware +37 more +39 moreIn TFA, there is a possible information disclosure due to a missing permission check. This could...4.4 Medium
- flipper code wp mapsWordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability4.3 Medium
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab8.5 High
- flytohub flyto-coreFlyto2 Core: LLM/API keys leak to an attacker-controlled base_url8.6 High
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`7.4 High
- yoomoney юkassa для woocommerceWordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Sensitive Data Exposure vulnerability6.5 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels6.5 Medium
- devolutions powershell universalInsertion of sensitive information into sent data in the automation jobs API in Devolutions...6.5 Medium
- pepro dev. group peprodev ultimate invoiceWordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensitive Data Exposure vulnerability6.5 Medium
- gitpython-developers gitpythonGitPython before 3.1.52 Environment Variable Exfiltration via clone_from8.7 High
- red hat enterprise linux 10Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch3.4 Low
- guzzleguzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer8.2 High
- guzzleguzzlehttp/guzzle before 7.15.1 Host-only Cookie Scope8.2 High
- guzzleguzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure6.9 Medium
- vsee clinic, clinic api +1 moreVSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses9.0 Critical
- cradle e-commerceSensitive Data Exposure in IKAS Technologies' E-Commerce7.5 High
- proliz software ltd. co. proliz's obsSensitive Data Exposure in Proliz's OBS7.5 High
- exconExcon: redact additional sensitive/risky headers when following redirects6.5 Medium
- hcl software devops deploy / hcl launch, hclsoftware hcl devops deploy / hcl launch, hcltechsw hcl devops deploy +1 more +3 moreHCL DevOps Deploy / HCL Launch is susceptible to an Insertion of Sensitive Information Into Sent Data vulnerability6.5 Medium
- sayax energy technologies inc. ososInformation Disclosure in Sayax's OSOS6.5 Medium
- go standard library crypto/tls, golang go +1 moreInvoking Encrypted Client Hello privacy leak in crypto/tls5.3 Medium
- softaculous formlayerWordPress FormLayer plugin <= 1.0.6 - Sensitive Data Exposure vulnerability5.3 Medium
- tim strifler exclusive addons elementorWordPress Exclusive Addons Elementor plugin <= 2.7.9.9 - Sensitive Data Exposure vulnerability5.3 Medium
- jetmonsters hotel booking liteWordPress Hotel Booking Lite plugin <= 6.0.3 - Sensitive Data Exposure vulnerability6.5 Medium
- Show moreLoading…