cve.bz

CWE-201: Insertion of Sensitive Information Into Sent Data, page 3

Filter

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

What the weakness is: CWE-201 at MITRE

Related attack patterns (CAPEC): 9
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-217 Exploiting Incorrectly Configured SSL/TLS Likelihood: Low
  • CAPEC-612 WiFi MAC Address Tracking Severity: Low
  • CAPEC-613 WiFi SSID Tracking Severity: Low
  • CAPEC-618 Cellular Broadcast Message Request Severity: Low
  • CAPEC-619 Signal Strength Tracking Severity: Low
  • CAPEC-621 Analysis of Packet Timing and Sizes Severity: Low
  • CAPEC-622 Electromagnetic Side-Channel Attack Severity: Low
  • CAPEC-623 Compromising Emanations Attack Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-201, as MITRE names them. Credits.

Ask an AI about CWE-201

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-201: Insertion of Sensitive Information Into Sent Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/201.html and https://cve.bz/cve/cwe/201?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-81162EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal vers…

  2. 6.5CVE-2026-81280EPSS 0.4%

    Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

  3. 7.5CVE-2026-55553EPSS 0.7%

    urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origin…

  4. 7.5CVE-2026-66585EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions.

  5. 6.9CVE-2026-59809EPSS 0.4%

    SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL conta…

  6. 6.9CVE-2026-63481EPSS 0.7%

    Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth crede…

  7. 7.5CVE-2026-75953EPSS 0.4%

    Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to…

  8. 7.5CVE-2026-73386EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions.

  9. 7.5CVE-2026-73384EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.

  10. 5.3CVE-2026-74008EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox t…

  11. 7.5CVE-2026-66463EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

  12. 7.5CVE-2026-66443EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

  13. 6.5CVE-2026-28174EPSS 0.4%

    Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.

  14. 7.5CVE-2026-47717ExploitEPSS 1.4%

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled…

  15. 6.5CVE-2026-16637EPSS 0.5%

    OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints.

  16. 3.3CVE-2026-64652EPSS 0.2%

    GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of…

  17. 4.3CVE-2026-66696EPSS 0.3%

    Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.

  18. 5.3CVE-2026-66685EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.

  19. 5.3CVE-2026-66684EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.

  20. 5.3CVE-2026-66683EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.

  21. 7.5CVE-2026-65543EPSS 0.4%

    Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.

  22. 7.5CVE-2026-66901EPSS 0.5%

    Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hos…

  23. 4.4CVE-2026-20484EPSS 0.2%

    In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploi…

  24. 8.2CVE-2026-67355EPSS 0.4%

    guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as host-only. Attackers controlling child hosts can receive host-only cookies intende…

  25. 8.2CVE-2026-67354EPSS 0.4%

    guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') fr…

  26. 4.3CVE-2026-28144EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.

  27. 5.3CVE-2026-6267EPSS 0.6%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to acces…

  28. 8.6CVE-2026-67425EPSS 0.4%

    Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to…

  29. 7.4CVE-2026-54660EPSS 0.3%

    swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDo…

  30. 6.3CVE-2026-64643EPSS 0.5%

    Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclose…

  31. 6.5CVE-2026-65434EPSS 0.4%

    Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

  32. 6.5CVE-2026-66339EPSS 0.2%

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This all…

  33. 6.5CVE-2026-16798EPSS 0.4%

    Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OA…

  34. 6.5CVE-2026-27372EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.

  35. 3.4CVE-2026-12547EPSS 0.2%

    SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous…

  36. 9.0CVE-2026-13380EPSS 0.4%

    VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within…

  37. 6.5CVE-2026-54171EPSS 0.4%

    Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could ca…

  38. 7.5CVE-2026-7488EPSS 0.4%

    Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026.

  39. 7.5CVE-2026-7189EPSS 0.4%

    Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0.

  40. 4.3CVE-2026-44970EPSS 0.4%

    dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent …

  41. 6.5CVE-2026-56460EPSS 0.4%

    HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

  42. 6.5CVE-2026-1365EPSS 0.5%

    Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass. This issue affects OSOS: through 09072026. NOTE: The vendor was contacted early about this disclosure but…

  43. 5.3CVE-2026-42505EPSS 0.4%

    Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

  44. 5.3CVE-2026-59519EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6.

  45. 5.3CVE-2026-59511EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9.

  46. 9.1CVE-2026-8924EPSS 0.7%

    A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits …

  47. 6.5CVE-2026-57347EPSS 0.4%

    Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.

  48. 6.5CVE-2025-69132EPSS 0.4%

    Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions.

  49. 7.4CVE-2026-57736EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51.

  50. 4.3CVE-2026-13211EPSS 0.2%

    The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role.