CWE-497— Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.— MITRE CWE catalog

472 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-497page 6 of 10

CVE-2026-28169MEDIUMCVSS 5.3EG 5.3
2026-08-06
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions.
CVE-2026-66438MEDIUMCVSS 5.3EG 5.3
2026-07-27
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
CVE-2026-65564MEDIUMCVSS 5.3EG 5.3
2026-07-27
Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
CVE-2026-44955MEDIUMCVSS 5.3EG 5.3
2026-07-23
Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.
CVE-2026-65521MEDIUMCVSS 5.3EG 5.3
2026-07-23
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
CVE-2026-65505MEDIUMCVSS 5.3EG 5.3
2026-07-23
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65498MEDIUMCVSS 5.3EG 5.3
2026-07-23
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
CVE-2026-65490MEDIUMCVSS 5.3EG 5.3
2026-07-23
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0.
CVE-2026-65474MEDIUMCVSS 5.3EG 5.3
2026-07-23
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
CVE-2026-61977MEDIUMCVSS 5.3EG 5.3
2026-07-13
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.
CVE-2026-61976MEDIUMCVSS 5.3EG 5.3
2026-07-13
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through …
CVE-2026-61975MEDIUMCVSS 5.3EG 5.3
2026-07-13
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.
CVE-2026-55726MEDIUMCVSS 5.3EG 5.3
2026-07-03
The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.
CVE-2026-57753MEDIUMCVSS 5.3EG 5.3
2026-07-02
Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions.
CVE-2026-57633MEDIUMCVSS 5.3EG 5.3
2026-06-26
Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions.
CVE-2026-49077MEDIUMCVSS 5.3EG 5.3
2026-06-04
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.
CVE-2026-41928MEDIUMCVSS 5.3EG 5.3
2026-05-07
Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authenticati…
CVE-2026-25468MEDIUMCVSS 5.3EG 5.3
2026-05-07
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitive Data. This issue affects Happy Addons for Elementor: from n/a through 3.20.8.
CVE-2026-42644MEDIUMCVSS 5.3EG 5.3
2026-04-29
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10.
CVE-2026-41335MEDIUMCVSS 5.3EG 5.3
2026-04-23
OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers. Attackers can extract sensitive fingerprinting information from the Co…
CVE-2026-41459MEDIUMCVSS 5.3EG 5.3
2026-04-22
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET reques…
CVE-2026-39686MEDIUMCVSS 5.3EG 5.3
2026-04-08
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitive Data.This issue affects BSK PDF Manager: from n/a through <= 3.7.2.
CVE-2026-39571MEDIUMCVSS 5.3EG 5.3
2026-04-08
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This issue affects Instantio: from n/a through <= 3.3.30.
CVE-2026-39536MEDIUMCVSS 5.3EG 5.3
2026-04-08
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive Data.This issue affects RSVP and Event Management: from n/a through <= 2…
CVE-2026-39516MEDIUMCVSS 5.3EG 5.3
2026-04-08
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retrieve Embedded Sensitive Data.This issue affects Nexter Blocks: from n/a through …
CVE-2026-33617MEDIUMCVSS 5.3EG 5.3
2026-04-02
An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.
CVE-2026-32405MEDIUMCVSS 5.3EG 5.3
2026-03-13
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in xtemos WoodMart woodmart allows Retrieve Embedded Sensitive Data.This issue affects WoodMart: from n/a through <= 8.3.9.
CVE-2026-32372MEDIUMCVSS 5.3EG 5.3
2026-03-13
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Retrieve Embedded Sensitive Data.This issue affects ShopBuilder…
CVE-2026-3075MEDIUMCVSS 5.3EG 5.3
2026-02-23
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Jeff Starr Simple Ajax Chat simple-ajax-chat allows Retrieve Embedded Sensitive Data.This issue affects Simple Ajax Chat: from n/a through <= 20251…
CVE-2026-25389MEDIUMCVSS 5.3EG 5.3
2026-02-19
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <…
CVE-2026-25325MEDIUMCVSS 5.3EG 5.3
2026-02-19
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Retrieve Embedded Sensitive Data.This issue affects rtMedia for WordPr…
CVE-2026-25023MEDIUMCVSS 5.3EG 5.3
2026-02-03
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mdedev Run Contests, Raffles, and Giveaways with ContestsWP contest-code-checker allows Retrieve Embedded Sensitive Data.This issue affects Run Con…
CVE-2026-24998MEDIUMCVSS 5.3EG 5.3
2026-02-03
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a th…
CVE-2023-37525MEDIUMCVSS 5.3EG 5.3
2026-01-28
A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to applicati…
CVE-2026-24593MEDIUMCVSS 5.3EG 5.3
2026-01-23
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: fr…
CVE-2026-0853MEDIUMCVSS 5.3EG 5.3
2026-01-12
Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the debug page and obtain device status information.
CVE-2025-31051MEDIUMCVSS 5.3EG 5.3
2026-01-07
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensitive Data.This issue affects Plant - Gardening & Houseplant…
CVE-2025-34171MEDIUMCVSS 5.3EG 5.3
2026-01-02
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user…
CVE-2025-62114MEDIUMCVSS 5.3EG 5.3
2025-12-31
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows Retrieve Embedded Sensitive Data.This issue affects Download Media Library: from…
CVE-2025-68943MEDIUMCVSS 5.3EG 5.3
2025-12-26
Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.
CVE-2024-58320MEDIUMCVSS 5.3EG 5.3
2025-12-18
An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentication. Attackers can retrieve confidential hostname configuration information th…
CVE-2019-25228MEDIUMCVSS 5.3EG 5.3
2025-12-18
An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with third-party domains. Sensitive virtual context information can be exposed to ex…
CVE-2025-67567MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.
CVE-2025-67565MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.
CVE-2025-67564MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects P…
CVE-2025-63009MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows Retrieve Embedded Sensitive Data.This issue affects WP Google Analytics Events:…
CVE-2025-62737MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensitive Data.This issue affects Image Cleanup: from n/a through <= 1.9.2.
CVE-2025-62735MEDIUMCVSS 5.3EG 5.3
2025-12-09
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded Sensitive Data.This issue affects User Spam Remover: from n/a through <= 1.1.
CVE-2025-36112MEDIUMCVSS 5.3EG 5.3
2025-11-24
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP configuration information to an unauthorized user.
CVE-2025-66059MEDIUMCVSS 5.3EG 5.3
2025-11-21
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Retrieve Embedded Sensitive Data.This issue affects Seriously Simple Po…

Map vulnerabilities like CWE-497 to your infrastructure

EchelonGraph correlates every CVE — across CWE-497 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →