cve.bz

CWE-201: Insertion of Sensitive Information Into Sent Data, page 4

Filter

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

What the weakness is: CWE-201 at MITRE

Related attack patterns (CAPEC): 9
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-217 Exploiting Incorrectly Configured SSL/TLS Likelihood: Low
  • CAPEC-612 WiFi MAC Address Tracking Severity: Low
  • CAPEC-613 WiFi SSID Tracking Severity: Low
  • CAPEC-618 Cellular Broadcast Message Request Severity: Low
  • CAPEC-619 Signal Strength Tracking Severity: Low
  • CAPEC-621 Analysis of Packet Timing and Sizes Severity: Low
  • CAPEC-622 Electromagnetic Side-Channel Attack Severity: Low
  • CAPEC-623 Compromising Emanations Attack Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-201, as MITRE names them. Credits.

Ask an AI about CWE-201

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-201: Insertion of Sensitive Information Into Sent Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/201.html and https://cve.bz/cve/cwe/201?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-12085EPSS 0.4%

    IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated u…

  2. 6.5CVE-2026-13437EPSS 0.4%

    Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication …

  3. 6.5CVE-2026-57318EPSS 0.4%

    Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions.

  4. 7.5CVE-2026-54834EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

  5. 6.5CVE-2026-55180EPSS 0.4%

    pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious re…

  6. 8.3CVE-2026-54848EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.

  7. 7.5CVE-2026-54841EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

  8. 7.4CVE-2026-54821EPSS 0.3%

    Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

  9. 6.7CVE-2026-22551EPSS 0.3%

    In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an att…

  10. 7.4CVE-2026-52698EPSS 0.2%

    Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation &amp; Chat Widget <= 4.2.3 versions.

  11. 7.5CVE-2026-34888EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions.

  12. 6.9CVE-2026-27868EPSS 0.4%

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via t…

  13. 6.5CVE-2024-35690EPSS 0.3%

    Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

  14. 6.5CVE-2026-54197EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

  15. 7.5CVE-2026-52695EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

  16. 7.5CVE-2026-52692EPSS 0.2%

    Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.

  17. 7.4CVE-2026-49082EPSS 0.3%

    Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons <= 1.4.8 versions.

  18. 6.5CVE-2026-48965EPSS 0.3%

    Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

  19. 7.5CVE-2026-42667EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

  20. 7.5CVE-2026-42384EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

  21. 7.5CVE-2026-40789EPSS 0.3%

    Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

  22. 7.5CVE-2026-39480EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.

  23. 7.5CVE-2026-49064EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.

  24. 6.5CVE-2026-7184EPSS 0.3%

    Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain …

  25. 8.2CVE-2026-44487EPSS 0.7%

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This…

  26. 7.5CVE-2026-44486EPSS 0.6%

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated…

  27. 8.3CVE-2026-46481EPSS 0.2%

    OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the …

  28. 6.5CVE-2026-42539EPSS 0.2%

    IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28…

  29. 4.3CVE-2026-45739EPSS 0.2%

    Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sen…

  30. 7.7CVE-2026-4035EPSS 0.5%

    A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlle…

  31. 6.5CVE-2026-44653EPSS 0.3%

    LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP server can retrieve the server's decrypted admin-managed secrets through `GET /api/m…

  32. 5.3CVE-2026-35447EPSS 0.2%

    NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and replies before verifying whether the viewer is authorized to access the profile. …

  33. 7.5CVE-2026-42673EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity allows Retrieve Embedded Sensitive Data. This issue affects Activity L…

  34. 7.5CVE-2026-49370EPSS 0.2%

    In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests

  35. 6.3CVE-2026-10101EPSS 0.2%

    ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace principal with the stock `view` ClusterRole cannot directly read Secrets, but ca…

  36. 6.5CVE-2026-45582EPSS 0.3%

    n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sanitizer could retain partial fragments of URL-shaped node parameters before sendin…

  37. 7.3CVE-2026-42746EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitive Data.This issue affects Smart Online Order for Clover: from n/a through <= 1.6…

  38. 6.5CVE-2026-48877EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data. This issue affects GenerateBlocks: from n/a through 2.1.0.

  39. 6.9CVE-2026-41181EPSS 0.4%

    Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's errors (custom error pages) middleware. When the backend returns a response matchin…

  40. 2.6CVE-2025-62309EPSS 0.1%

    HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific cond…

  41. 5.1CVE-2025-62308EPSS 0.1%

    HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further…

  42. 5.1CVE-2025-62305EPSS 0.1%

    HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems u…

  43. 5.3CVE-2026-45215EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP EasyPay: from n/a through <= 4.3.0.

  44. 9.6CVE-2026-42880EPSS 0.6%

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allow…

  45. 4.3CVE-2025-31978EPSS 0.1%

    HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt…

  46. 7.7CVE-2026-42997EPSS 0.4%

    An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpoint. The credential forwarded is a time-limited Keystone token (which provides a…

  47. 7.7CVE-2026-42379EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.

  48. 5.4CVE-2026-42042EPSS 0.2%

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken…

  49. 5.3CVE-2026-5512EPSS 0.3%

    An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not per…

  50. 6.5CVE-2026-40161EPSS 0.3%

    Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the syst…