CWE-201: Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- pgjdbcpgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)5.3 Medium
- pgjdbcpgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections4.2 Medium
- drupal two factor authentication - tfa / passwordless loginTwo Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-2074.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information exposure in Scaffolder9.6 Critical
- automattic wordpressWordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability6.9 Medium
- payloadcms payloadPayload: API key disclosure through ordinary document reads7.7 High
- stylemixthemes motorsWordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability6.9 Medium
- royal plugins sitevault – backup, restore, migration & cloningWordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability7.5 High
- adrian tobey groundhoggWordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability7.5 High
- daftplug snapshotify – all-in-one backup & restore & migrateWordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability7.5 High
- norvisgabriel norvis backupWordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability7.5 High
- adrian lin museder restoreoneWordPress Museder RestoreOne plugin <= 2.7.276 - Sensitive Data Exposure vulnerability7.5 High
- pluginjoy safesnap – verified wordpress backup & restoreWordPress SafeSnap – Verified WordPress Backup & Restore plugin <= 2.1.2 - Sensitive Data Exposure vulnerability7.5 High
- mailjet email marketingWordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability5.3 Medium
- wisdmlabs edwiser bridgeWordPress Edwiser Bridge plugin <= 4.3.4 - Sensitive Data Exposure vulnerability7.2 High
- dawer drew sitemovrWordPress Sitemovr plugin <= 1.0.1 - Sensitive Data Exposure vulnerability7.5 High
- docling, docling-project docling-slim +1 moreDocling: Configured HTTP headers sent to every remote image host named by a document3.7 Low
- etoile web design incorporated five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability7.5 High
- deepen bajracharya video conferencing with zoomWordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability5.3 Medium
- pixelite events managerWordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability5.3 Medium
- farvisun mindio magic mcpWordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability4.3 Medium
- stylemix cost calculator builderWordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability7.5 High
- aws loomServer-side request forgery in the OAuth2 discovery handling in Loom for AWS8.2 High
- chiranjit hazarika smart one click setup – complete demo import & exportWordPress Smart One Click Setup – Complete Demo Import & Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability5.3 Medium
- eclipse foundation basyx aas web uiIn Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared...8.3 High
- wpexperts cf7 appsWordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability5.3 Medium
- genetech products pie registerWordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability5.3 Medium
- smackcoders inc. wp ultimate csv importerWordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability5.3 Medium
- tryghost ghostGhost 3.23.0 before 6.23.0 API Key Exposure via Admin API5.3 Medium
- tryghost ghostGhost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint6.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read...4.3 Medium
- themeisle mpgWordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability5.3 Medium
- villatheme notivoWordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability5.3 Medium
- precisionwp backupeaseWordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability7.5 High
- esteban stifli backup toolsWordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability7.5 High
- parla auto automotive trading limited company detawix mobile web portalSensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal7.5 High
- alam00000 bentopdfBentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests3.4 Low
- punchin-app punchin-emailpunchin-email: Operator inbox (FORWARD_TO) disclosed to correspondents on reply — Cloudflare forward() drops the relay Reply-To2.1 Low
- gitlabInsertion of Sensitive Information Into Sent Data in GitLab5.3 Medium
- growthbookGrowthBook through 5.0.1 Information Disclosure via Public Endpoints6.9 Medium
- apache software foundation syncopeApache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user7.5 High
- amazon kiro ideKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration6.7 Medium
- 10up elasticpressWordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability5.3 Medium
- zain hassan zhbackup – backup, restore & migrationWordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability7.5 High
- joomlart.com t4 page builder extension for joomlaJoomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.06.9 Medium
- joomshaper.com sp property extension for joomlaJoomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.46.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: A user's session cookies are sent to tool servers configured for bearer authentication6.8 Medium
- microsoft teams for android, teams +1 moreMicrosoft Teams for Android Information Disclosure Vulnerability6.8 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to...3.3 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication...6.8 Medium
- Show moreLoading…