CWE-201— Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog

525 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-201page 10 of 11

CVE-2026-19601MEDIUMCVSS 4.9EG 4.9
2026-10-16
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a Syste…
CVE-2026-59809MEDIUMCVSS 4.9EG 4.9
2026-08-22
SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL conta…
CVE-2025-15329MEDIUMCVSS 4.9EG 4.9
2026-02-05
Tanium addressed an information disclosure vulnerability in Threat Response.
CVE-2020-1774MEDIUMCVSS 4.5EG 4.9
2020-04-28
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS))…
CVE-2025-64299MEDIUMCVSS 2.7EG 4.9
2025-11-21
LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.
CVE-2025-31978MEDIUMCVSS 4.3EG 4.6
2026-05-06
HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt…
CVE-2026-20484MEDIUMCVSS 4.4EG 4.4
2026-08-03
In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploi…
CVE-2025-20789MEDIUMCVSS 4.4EG 4.4
2025-12-02
In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: A…
CVE-2026-107268MEDIUMCVSS 4.3EG 4.3
2026-10-30
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from…
CVE-2026-114485MEDIUMCVSS 4.3EG 4.3
2026-10-22
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via th…
CVE-2026-19603MEDIUMCVSS 4.3EG 4.3
2026-10-16
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID o…
CVE-2026-89203MEDIUMCVSS 4.3EG 4.3
2026-10-13
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for thei…
CVE-2026-104402MEDIUMCVSS 4.3EG 4.3
2026-10-04
Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.
CVE-2026-100258MEDIUMCVSS 4.3EG 4.3
2026-09-30
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
CVE-2026-66696MEDIUMCVSS 4.3EG 4.3
2026-08-06
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-28144MEDIUMCVSS 4.3EG 4.3
2026-07-31
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.
CVE-2026-44970MEDIUMCVSS 4.3EG 4.3
2026-07-16
dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent …
CVE-2026-13211MEDIUMCVSS 4.3EG 4.3
2026-07-01
The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role.
CVE-2026-45739MEDIUMCVSS 4.3EG 4.3
2026-05-19
Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sen…
CVE-2026-5512MEDIUMCVSS 4.3EG 4.3
2026-04-21
An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not per…
CVE-2026-2578MEDIUMCVSS 4.3EG 4.3
2026-03-16
Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion which allows channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event.. Mattermo…
CVE-2026-1694MEDIUMCVSS 4.3EG 4.3
2026-02-26
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.…
CVE-2026-25008MEDIUMCVSS 4.3EG 4.3
2026-02-19
Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue affects Ninja Tables: from n/a through <= 5.2.5.
CVE-2026-22246MEDIUMCVSS 4.3EG 4.3
2026-01-08
Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code…
CVE-2025-63007MEDIUMCVSS 4.3EG 4.3
2025-12-09
Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.4.1.
CVE-2025-62994MEDIUMCVSS 4.3EG 4.3
2025-12-09
Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.
CVE-2025-7000MEDIUMCVSS 4.3EG 4.3
2025-11-15
An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch n…
CVE-2025-64351MEDIUMCVSS 4.3EG 4.3
2025-10-31
Insertion of Sensitive Information Into Sent Data vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Retrieve Embedded Sensitive Data.This issue affects Rank Math SEO: from n/a through <= 1.0.252.1.
CVE-2025-62026MEDIUMCVSS 4.3EG 4.3
2025-10-22
Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through <= 3.2.13.2.
CVE-2024-47569MEDIUMCVSS 4.3EG 4.3
2025-10-14
A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, For…
CVE-2025-60095MEDIUMCVSS 4.3EG 4.3
2025-09-26
Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.
CVE-2025-58246MEDIUMCVSS 4.3EG 4.3
2025-09-23
Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is aware of the issue and is already working on a fix. This is a low-severity vulnerabil…
CVE-2025-58649MEDIUMCVSS 4.3EG 4.3
2025-09-22
Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.7.1.
CVE-2025-58252MEDIUMCVSS 4.3EG 4.3
2025-09-22
Insertion of Sensitive Information Into Sent Data vulnerability in jetmonsters Getwid getwid allows Retrieve Embedded Sensitive Data.This issue affects Getwid: from n/a through <= 2.1.2.
CVE-2025-58249MEDIUMCVSS 4.3EG 4.3
2025-09-22
Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.
CVE-2025-44017MEDIUMCVSS 4.3EG 4.3
2025-09-02
"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accesses a crafted URL, an attacker may obtain the JWT (JSON Web Token).
CVE-2025-55710MEDIUMCVSS 4.3EG 4.3
2025-08-14
Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects TaxoPress: from n/a through <= 3.37.2.
CVE-2025-48381MEDIUMCVSS 4.3EG 4.3
2025-05-30
Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tas…
CVE-2025-2565MEDIUMCVSS 4.3EG 4.3
2025-03-20
The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through up…
CVE-2024-45653MEDIUMCVSS 4.3EG 4.3
2025-01-19
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system.
CVE-2024-8429MEDIUMCVSS 4.3EG 4.3
2024-12-17
Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials. This issue affects WiFiBurada: before 1.0.5.
CVE-2021-1425MEDIUMCVSS 4.3EG 4.3
2024-11-18
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected de…
CVE-2024-47128MEDIUMCVSS 4.3EG 4.3
2024-09-26
The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations.
CVE-2024-43814MEDIUMCVSS 4.3EG 4.3
2024-09-26
The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is active and goTenna is connected. Users that are unaware of their settings and ha…
CVE-2024-41931MEDIUMCVSS 4.3EG 4.3
2024-09-26
The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share the encryption key via local QR for higher security operations.
CVE-2024-32796MEDIUMCVSS 4.3EG 4.3
2024-04-24
Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue affects WP Fusion Lite: from n/a through <= 3.42.10.
CVE-2024-32782MEDIUMCVSS 4.3EG 4.3
2024-04-24
Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7.
CVE-2024-31278MEDIUMCVSS 4.3EG 4.3
2024-04-10
Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium Addons for Elementor: from n/a through <= 4.10.22.
CVE-2024-28173MEDIUMCVSS 4.3EG 4.3
2024-03-06
In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed
CVE-2024-25150MEDIUMCVSS 4.3EG 4.3
2024-02-20
Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions allows remote auth…

Map vulnerabilities like CWE-201 to your infrastructure

EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →