CWE-201— Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.— MITRE CWE catalog
525 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-201page 4 of 11
- CVE-2024-56300HIGHCVSS 7.5EG 7.52025-01-07
Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n…
- CVE-2024-53804HIGHCVSS 7.5EG 7.52024-12-06
Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.
- CVE-2024-49235HIGHCVSS 7.5EG 7.52024-10-17
Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, C…
- CVE-2024-38787HIGHCVSS 7.5EG 7.52024-08-13
Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.8.
- CVE-2024-32825HIGHCVSS 7.5EG 7.52024-04-24
Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.
- CVE-2023-49261HIGHCVSS 7.5EG 7.52024-01-12
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CVE-2023-52190HIGHCVSS 7.5EG 7.52024-01-08
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Swings Coupon Referral Program.This issue affects Coupon Referral Program: from n/a through 1.7.2.
- CVE-2020-8975HIGHCVSS 7.5EG 7.52022-10-17
ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system.
- CVE-2016-10519HIGHCVSS 7.5EG 7.52018-05-31
A security issue was found in bittorrent-dht before 5.1.3 that allows someone to send a specific series of messages to a listening peer and get it to reveal internal memory.
- CVE-2016-10518HIGHCVSS 7.5EG 7.52018-05-31
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given paylo…
- CVE-2025-59578HIGHCVSS 5.8EG 7.52025-10-22
Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.
- CVE-2025-53218HIGHCVSS 5.8EG 7.52025-10-22
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.5.
- CVE-2025-63019HIGHCVSS 5.3EG 7.52026-01-22
Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content…
- CVE-2025-62109HIGHCVSS 5.3EG 7.52025-12-09
Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.
- CVE-2025-62895HIGHCVSS 5.3EG 7.52025-10-27
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.
- CVE-2025-47444HIGHCVSS 5.3EG 7.52025-08-12
Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.
- CVE-2025-68516HIGHCVSS 5.0EG 7.52025-12-24
Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.
- CVE-2025-62947HIGHCVSS 5.0EG 7.52025-10-27
Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through <= 2.2.5.
- CVE-2025-68989HIGHCVSS 4.3EG 7.52025-12-30
Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-exte…
- CVE-2026-101043HIGHCVSS 7.4EG 7.42026-09-27
pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-…
- CVE-2026-54660HIGHCVSS 7.4EG 7.42026-07-29
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDo…
- CVE-2026-57736HIGHCVSS 7.4EG 7.42026-07-01
Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.
- CVE-2026-54821HIGHCVSS 7.4EG 7.42026-06-25
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.
- CVE-2026-52698HIGHCVSS 7.4EG 7.42026-06-17
Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions.
- CVE-2026-49082HIGHCVSS 7.4EG 7.42026-06-15
Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions.
- CVE-2026-42746HIGHCVSS 7.3EG 7.32026-05-27
Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitive Data.This issue affects Smart Online Order for Clover: from n/a through <= 1.6…
- CVE-2026-20151HIGHCVSS 7.3EG 7.32026-04-01
A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to the improper transmission…
- CVE-2024-6586HIGHCVSS 7.3EG 7.32024-08-30
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an…
- CVE-2026-39729HIGHCVSS 7.2EG 7.22026-10-06
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
- CVE-2026-1777HIGHCVSS 7.2EG 7.22026-02-02
The Amazon SageMaker Python SDK before v3.2.0 and v2.256.0 includes the ModelBuilder HMAC signing key in the cleartext response elements of the DescribeTrainingJob function. A third party with permissions to both call this API and permissi…
- CVE-2025-66304HIGHCVSS 7.2EG 7.22025-12-01
Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially …
- CVE-2023-6916HIGHCVSS 7.2EG 7.22024-04-10
Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.
- CVE-2026-113459HIGHCVSS 7.1EG 7.12026-10-20
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key an…
- CVE-2025-8862HIGHCVSS 7.0EG 7.02025-08-11
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacte…
- CVE-2026-105877MEDIUMCVSS 6.9EG 6.92026-10-09
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0.
- CVE-2026-66666MEDIUMCVSS 6.9EG 6.92026-10-06
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.…
- CVE-2026-104399MEDIUMCVSS 6.9EG 6.92026-10-06
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
- CVE-2026-78374MEDIUMCVSS 6.9EG 6.92026-09-10
Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captc…
- CVE-2026-78303MEDIUMCVSS 6.9EG 6.92026-09-10
Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potent…
- CVE-2026-63481MEDIUMCVSS 6.9EG 6.92026-08-20
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth crede…
- CVE-2026-27868MEDIUMCVSS 6.9EG 6.92026-06-17
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via t…
- CVE-2025-64502MEDIUMCVSS 6.9EG 6.92025-11-10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning be…
- CVE-2026-123513MEDIUMCVSS 6.8EG 6.82026-11-08
Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens i…
- CVE-2026-87015MEDIUMCVSS 6.8EG 6.82026-09-09
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each extern…
- CVE-2026-65812MEDIUMCVSS 6.8EG 6.82026-09-08
Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- CVE-2026-86497MEDIUMCVSS 6.8EG 6.82026-09-07
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials
- CVE-2025-7708MEDIUMCVSS 6.8EG 6.82026-02-09
Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulation. This issue affects k12net: through 26072025.
- CVE-2024-4536MEDIUMCVSS 6.8EG 6.82024-05-07
In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obtain OAuth2 client secrets from the vault. In Eclipse Dataspace Components from …
- CVE-2026-87801MEDIUMCVSS 6.5EG 6.52026-11-12
An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.
- CVE-2026-120716MEDIUMCVSS 6.5EG 6.52026-11-03
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity prov…
Map vulnerabilities like CWE-201 to your infrastructure
EchelonGraph correlates every CVE — across CWE-201 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →