cve.bz

CWE-201: Insertion of Sensitive Information Into Sent Data, page 6

Filter

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

What the weakness is: CWE-201 at MITRE

Related attack patterns (CAPEC): 9
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-217 Exploiting Incorrectly Configured SSL/TLS Likelihood: Low
  • CAPEC-612 WiFi MAC Address Tracking Severity: Low
  • CAPEC-613 WiFi SSID Tracking Severity: Low
  • CAPEC-618 Cellular Broadcast Message Request Severity: Low
  • CAPEC-619 Signal Strength Tracking Severity: Low
  • CAPEC-621 Analysis of Packet Timing and Sizes Severity: Low
  • CAPEC-622 Electromagnetic Side-Channel Attack Severity: Low
  • CAPEC-623 Compromising Emanations Attack Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-201, as MITRE names them. Credits.

Ask an AI about CWE-201

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-201: Insertion of Sensitive Information Into Sent Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/201.html and https://cve.bz/cve/cwe/201?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-24565EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in bPlugins B Accordion b-accordion allows Retrieve Embedded Sensitive Data.This issue affects B Accordion: from n/a through <= 2.0.2.

  2. 5.3CVE-2026-24559EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubspot allows Retrieve Embedded Sensitive Data.This issue affects Integration for Contact Form 7 HubSpot: from n/a thr…

  3. 5.3CVE-2026-24557EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in WEN Solutions Contact Form 7 GetResponse Extension contact-form-7-getresponse-extension allows Retrieve Embedded Sensitive Data.This issue affects Contact Form 7 GetRespons…

  4. 7.5CVE-2025-68035EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.

  5. 6.5CVE-2025-68006EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

  6. 5.3CVE-2025-63019EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content …

  7. 6.5CVE-2026-23878EPSS 0.3%

    HotCRP is conference review software. Starting in commit aa20ef288828b04550950cf67c831af8a525f508 and prior to commit ceacd5f1476458792c44c6a993670f02c984b4a0, authors with at least one submission on a HotCRP site could use the document AP…

  8. 4.3CVE-2026-22246EPSS 0.3%

    Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code…

  9. 7.5CVE-2025-67931EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulletProof Security: from n/a through <= 6.9.

  10. 5.3CVE-2026-22539EPSS 0.2%

    As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.

  11. 5.7CVE-2025-59955EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/memb…

  12. 7.5CVE-2025-68033EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.This issue affects Custom Related Posts: from n/a through <= 1.8.0.

  13. 6.3CVE-2025-68029EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Wallet System for WooCommerce: from n/a thr…

  14. 6.5CVE-2025-68014EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through <= 3.2.26.

  15. 5.3CVE-2025-62126ExploitEPSS 0.7%

    Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Retrieve Embedded Sensitive Data.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.

  16. 5.3CVE-2025-59136ExploitEPSS 0.7%

    Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.

  17. 5.3CVE-2025-62139EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive Data.This issue affects Terms descriptions: from n/a through <= 3.4.10.

  18. 5.8CVE-2025-59003EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in inkthemescom ColorWay colorway allows Retrieve Embedded Sensitive Data.This issue affects ColorWay: from n/a through <= 4.2.3.

  19. 4.3CVE-2025-68989EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-exte…

  20. 6.5CVE-2025-68040EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.

  21. 5.0CVE-2025-68516EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.

  22. 5.0CVE-2025-62998EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.

  23. 5.3CVE-2025-14823EPSS 0.2%

    In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain condi…

  24. 7.5CVE-2025-66116EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Member Widgets …

  25. 6.5CVE-2025-64295EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.

  26. 7.5CVE-2025-64218EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in WP Chill Passster content-protector allows Retrieve Embedded Sensitive Data.This issue affects Passster: from n/a through <= 4.2.19.

  27. 7.5CVE-2025-64213EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS Pro: from n/a t…

  28. 5.8CVE-2025-49919EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Retrieve Embedded Sensitive Data.This issue affects eRoom: from n/a through <= 1.5.6.

  29. 5.9CVE-2025-49918EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Retrieve Embedded Sensitive Data.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through…

  30. 5.3CVE-2025-66126EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Data.This issue affects Fix Media Library: from n/a through <= 2.0.

  31. 5.3CVE-2025-66125EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

  32. 2.7CVE-2025-49300EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.This issue affects Traveler Option Tree: from n/a through 2.8.

  33. 6.5CVE-2025-66388EPSS 0.5%

    A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without the appropriate authorization. Users ar…

  34. 6.3CVE-2025-67721EPSS 0.5%

    Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allo…

  35. 5.3CVE-2025-63071EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme…

  36. 4.3CVE-2025-63007EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Retrieve Embedded Sensitive Data.This issue affects EventPrime: from n/a through <= 4.2.4.1.

  37. 5.3CVE-2025-62997EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Retrieve Embedded Sensitive Data.This issue affects WP EasyCart: from n/a through <= 5.8.11.

  38. 4.3CVE-2025-62994EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This issue affects WP AI CoPilot: from n/a through <= 1.2.7.

  39. 5.3CVE-2025-62109EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in INFINITUM FORM Geo Controller cf-geoplugin allows Retrieve Embedded Sensitive Data.This issue affects Geo Controller: from n/a through <= 8.9.4.

  40. 8.2CVE-2025-66566EPSS 0.6%

    yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted co…

  41. 8.3CVE-2025-58098EPSS 1.4%

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users …

  42. 7.5CVE-2025-13295EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Argus Technology Inc. BILGER allows Choosing Message Identifier. This issue affects BILGER: before 2.4.9.

  43. 4.4CVE-2025-20789EPSS 0.08%

    In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: A…

  44. 7.2CVE-2025-66304EPSS 0.4%

    Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially …

  45. 7.7CVE-2025-66035EPSS 0.7%

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in…

  46. 5.1CVE-2025-65944EPSS 0.4%

    Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the Sentry SDK has sendDefaultPii: true it is possible to inadvertently send certain sensitive HTTP heade…

  47. 6.9CVE-2025-64299EPSS 0.3%

    LogStare Collector improperly handles the password hash data. An administrative user may obtain the other users' password hashes.

  48. 6.5CVE-2025-52639EPSS 0.2%

    HCL Connections is vulnerable to a sensitive information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper rendering of application data.

  49. 4.3CVE-2025-7000EPSS 0.4%

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could have allowed unauthorized users to view confidential branch n…

  50. 6.5CVE-2025-2615EPSS 0.4%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that could have allowed a blocked user to access sensitive information by establishing GraphQL subs…