cve.bz

CWE-201: Insertion of Sensitive Information Into Sent Data, page 2

Filter

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

What the weakness is: CWE-201 at MITRE

Related attack patterns (CAPEC): 9
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-217 Exploiting Incorrectly Configured SSL/TLS Likelihood: Low
  • CAPEC-612 WiFi MAC Address Tracking Severity: Low
  • CAPEC-613 WiFi SSID Tracking Severity: Low
  • CAPEC-618 Cellular Broadcast Message Request Severity: Low
  • CAPEC-619 Signal Strength Tracking Severity: Low
  • CAPEC-621 Analysis of Packet Timing and Sizes Severity: Low
  • CAPEC-622 Electromagnetic Side-Channel Attack Severity: Low
  • CAPEC-623 Compromising Emanations Attack Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-201, as MITRE names them. Credits.

Ask an AI about CWE-201

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-201: Insertion of Sensitive Information Into Sent Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/201.html and https://cve.bz/cve/cwe/201?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.7CVE-2026-105849EPSS 0.3%

    Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with u…

  2. 7.5CVE-2026-42413EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.

  3. 7.5CVE-2026-41562EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

  4. 7.5CVE-2026-41561EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.

  5. 7.5CVE-2026-41559EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.

  6. 5.3CVE-2026-39791EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.

  7. 7.2CVE-2026-39729EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.

  8. 7.5CVE-2026-105071EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.

  9. 6.9CVE-2026-104399EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

  10. 7.5CVE-2026-104385EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.

  11. 7.5CVE-2026-41563EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions.

  12. 5.3CVE-2026-105742EPSS 0.3%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forw…

  13. 7.5CVE-2026-103334EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Res…

  14. 5.3CVE-2026-105068EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5.

  15. 5.3CVE-2026-103335EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: fr…

  16. 4.3CVE-2026-104402EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6.

  17. 7.5CVE-2026-97307EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.

  18. 8.2CVE-2026-103957EPSS 0.4%

    Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests …

  19. 5.3CVE-2026-32584EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import &amp; Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Clic…

  20. 8.3CVE-2026-101322EPSS 0.3%

    In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In dep…

  21. 5.3CVE-2026-62058EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2.

  22. 5.3CVE-2026-103345EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13.

  23. 5.3CVE-2026-103336EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1.

  24. 5.3CVE-2026-103281EPSS 0.2%

    Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are …

  25. 6.9CVE-2026-103280EPSS 0.2%

    Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it.

  26. 4.3CVE-2026-100258EPSS 0.7%

    In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings

  27. 5.3CVE-2026-97302EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.

  28. 5.3CVE-2026-97261EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.

  29. 7.5CVE-2026-97241EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.

  30. 7.5CVE-2026-97240EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.

  31. 7.5CVE-2026-86450EPSS 0.2%

    Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile …

  32. 8.3CVE-2026-101043EPSS 0.3%

    pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-…

  33. 3.4CVE-2026-63630EPSS 0.4%

    BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the craft…

  34. 2.1CVE-2026-54649EPSS 0.8%

    punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To…

  35. 4.3CVE-2026-82837EPSS 0.2%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials an…

  36. 6.9CVE-2026-91198EPSS 0.4%

    GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment…

  37. 7.5CVE-2026-78336EPSS 0.4%

    Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all …

  38. 6.7CVE-2026-89332EPSS 0.2%

    Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafte…

  39. 5.3CVE-2026-62088EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

  40. 7.5CVE-2026-81804EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versions.

  41. 6.9CVE-2026-78374EPSS 0.5%

    Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captc…

  42. 6.9CVE-2026-78303EPSS 0.4%

    Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potent…

  43. 6.8CVE-2026-87015EPSS 0.5%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each extern…

  44. 6.8CVE-2026-65812EPSS 0.9%

    Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

  45. 3.3CVE-2026-86505EPSS 0.2%

    In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

  46. 6.8CVE-2026-86497EPSS 0.5%

    In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

  47. 8.2CVE-2026-82209EPSS 0.4%

    When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Doma…

  48. 7.5CVE-2026-80255EPSS 0.5%

    A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent ov…

  49. 5.3CVE-2026-85307EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.

  50. 6.0CVE-2026-77123EPSS 0.5%

    Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, …