CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
A kind of CWE-200 Information Disclosure.
From the CWE List. © The MITRE Corporation.
Newest
- freescout-help-desk freescout FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets 5.3 Medium
- jreviews.com jreviews component for joomla Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 8.2 High
- doofinder for woocommerce WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability 7.5 High
- @clerk nuxt Nuxt dev server exposes private runtime config through the Nitro dev bundle 5.9 Medium
- elastic cloud enterprise Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure 6.4 Medium
- elastic cloud enterprise Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation 6.4 Medium
- wp desk shopmagic WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability 5.3 Medium
- light0011 cms light0011 cms Uploadify check-exists.php file_exists file information disclosure 6.9 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 more Clevis: clevis: pkcs#11 token pin written to world-readable file 4.7 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +8 more +10 more Windows Storage Information Disclosure Vulnerability 5.5 Medium
- code-projects online ticket reservation system code-projects Online Ticket Reservation System medallion.sql file information disclosure 6.9 Medium
- qexo Qexo initialization endpoint can reset setup state and expose stored credentials 9.3 Critical
- No product listed An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were... 2.3 Low
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 3.3 Low
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +8 more +10 more Microsoft Windows Search Component Information Disclosure Vulnerability 5.7 Medium
- j2commerce.com j2store extension for joomla Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 6.9 Medium
- sourcecodester online clothing store SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosure 6.9 Medium
- ibm business automation insights, cloud pak for business automation +1 more Insertion of Sensitive Information into Externally-Accessible File in IBM Business Automation Insights 5.3 Medium
- red hat openshift ai 2.25, openshift ai 3.4 +1 more Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default 7.5 High
- ibm db2 IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables 5.5 Medium
- bitbonsai mcpvault MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested 6.9 Medium
- naxclow ix cam, smart doorbell x3, v720 +1 more +3 more Naxclow IoT Platform Insertion of sensitive information into Externally-Accessible file or directory 5.1 Medium
- fission Fission builder pods auto-mount the fission-builder ServiceAccount token in the user-supplied builder container 4.9 Medium
- dahua ipc A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA... 2.3 Low
- dräger infinity delta, draeger delta xl firmware, infinity delta firmware +3 more +5 more Dräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File Disclosure 5.3 Medium
- sourcecodester pet grooming management software SourceCodester Pet Grooming Management Software admin file information disclosure 6.9 Medium
- apache airflow Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line Arguments 8.8 High
- fission Fission runtime pods automount the fission-fetcher service-account token into the user function container, granting function code namespace-wide secret / configmap read 8.7 High
- honeywell international inc. control network module (cnm) Improper storage of sensitive information 5.9 Medium
- apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +1 more Apache Airflow CNCF Kubernetes provider: JWT Token Exposure in KubernetesExecutor Command-Line Arguments 8.7 High
- backupbliss wordpress plugin backup migration WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download 8.7 High
- codeastro online job portal CodeAstro Online Job Portal user-cvs file information disclosure 6.9 Medium
- code-projects simple chatbox code-projects Simple ChatBox Endpoint chatbox.sql SimpleChatbox_PHP file information disclosure 6.9 Medium
- across dr-810 Across DR-810 ROM-0 Unauthenticated File Disclosure 8.7 High
- chamilo lms, chamilo-lms +1 more Chamilo LMS has unauthenticated access to Twig template source files exposes application logic 5.3 Medium
- ibm qradar siem, qradar security information and event manager +1 more IBM QRadar SIEM Information Disclosure 6.2 Medium
- hcl aion HCL AION is affected by an internal filesystem paths disloser vulnerability 3.3 Low
- zkteco inc. zktime.net ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation 9.3 Critical
- veeam backup and replication A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication... 8.8 High
- vmware spring data geode, spring data gemfire +1 more Spring Data Geode Insecure Temporary Directory Usage 4.8 Medium
- astpp ASTPP 4.0.1 VoIP Billing - Database Backup Download 8.7 High
- logo software industry and trade inc. j-platform Improper Access Control in Logo Software's Logo j-Platform 9.8 Critical
- zoll epcr ios mobile application ZOLL ePCR IOS Mobile Application Insertion of Sensitive Information into Externally-Accessible File or Directory 6.7 Medium
- ibm business automation workflow containers, business automation workflow +1 more Multiple security vulnerabilities are addressed in IBM Business Automation Workflow Containers fixes December 2025 5.5 Medium
- nixos nixpkgs Tandoor Recipes module allows SQLite database to be externally accessible with the default settings 8.7 High
- storybook Storybook manager bundle may expose environment variables during build 7.3 High
- qlik sense Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/... 7.5 High
- tg8 firewall TG8 Firewall Unauthenticated User Password Disclosure 8.7 High
- ubee interactive evw3226 Ubee EVW3226 Unauthenticated Backup File Disclosure 8.7 High
- shelfplanner shelf planner inventory management for woocommerce Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files 5.3 Medium
- Show olderLoading…