cve.bz

CWE-201: Insertion of Sensitive Information Into Sent Data, page 8

Filter

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

What the weakness is: CWE-201 at MITRE

Related attack patterns (CAPEC): 9
  • CAPEC-12 Choosing Message Identifier Likelihood: High · Severity: High
  • CAPEC-217 Exploiting Incorrectly Configured SSL/TLS Likelihood: Low
  • CAPEC-612 WiFi MAC Address Tracking Severity: Low
  • CAPEC-613 WiFi SSID Tracking Severity: Low
  • CAPEC-618 Cellular Broadcast Message Request Severity: Low
  • CAPEC-619 Signal Strength Tracking Severity: Low
  • CAPEC-621 Analysis of Packet Timing and Sizes Severity: Low
  • CAPEC-622 Electromagnetic Side-Channel Attack Severity: Low
  • CAPEC-623 Compromising Emanations Attack Severity: Low

The attack patterns MITRE's CAPEC relates to CWE-201, as MITRE names them. Credits.

Ask an AI about CWE-201

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-201: Insertion of Sensitive Information Into Sent Data and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/201.html and https://cve.bz/cve/cwe/201?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2025-53983EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements allows Retrieve Embedded Sensitive Data.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.

  2. 6.5CVE-2025-53196EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.

  3. 10.0CVE-2025-49408EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data. This issue affects Templately: from n/a through 3.2.7.

  4. 4.3CVE-2025-55710EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects TaxoPress: from n/a through <= 3.37.2.

  5. 6.5CVE-2025-54685EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through <= 1.1.0.

  6. 7.0CVE-2025-8862EPSS 0.4%

    YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacte…

  7. 6.5CVE-2025-7204EPSS 0.4%

    In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encry…

  8. 5.3CVE-2025-53322EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Authorize.NET Payments Using Contact Form 7 accept-authorize-net-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects …

  9. 5.3CVE-2025-53309EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in ZealousWeb Accept Stripe Payments Using Contact Form 7 accept-stripe-payments-using-contact-form-7 allows Retrieve Embedded Sensitive Data.This issue affects Accept Stripe …

  10. 8.7CVE-2025-49584EPSS 0.4%

    XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page whose reference is known can be accessed through the REST API as long as an XCla…

  11. 7.5CVE-2025-48261EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.

  12. 5.3CVE-2025-49294EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawloma…

  13. 5.3CVE-2025-5733EPSS 0.4%

    The Modern Events Calendar Lite plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 7.21.9. This is due improper or insufficient validation of the id property when exporting calendars. This make…

  14. 5.5CVE-2025-48934EPSS 0.4%

    Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the `Deno.env.toObject` method ignores any variables listed in the `--deny-env` option of the `deno run` command. When looking at the documenta…

  15. 5.5CVE-2025-31134EPSS 0.5%

    FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, an attacker can gain additional information about the server by checking if certain directories exist. An attacker can, for example, check if older PHP versions are in…

  16. 5.3CVE-2025-48996EPSS 0.4%

    HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management …

  17. 7.5CVE-2025-48331EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Custo…

  18. 5.3CVE-2025-48381EPSS 0.3%

    Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the IDs and names of all tas…

  19. 8.7CVE-2025-48045EPSS 0.6%

    An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.

  20. 9.1CVE-2025-48749EPSS 0.4%

    Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Information into Sent Data.

  21. 5.3CVE-2025-39498EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7…

  22. 7.5CVE-2025-47541EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through <= 1.17.7.

  23. 3.5CVE-2025-48219EPSS 0.3%

    O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading the utran-cell-id-3gpp field of a Cellular-Network-Info SIP header, aka an ECI (E…

  24. 8.6CVE-2025-47775EPSS 0.5%

    Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.

  25. 8.2CVE-2025-3529EPSS 0.4%

    The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'file_url' parameter. This makes it possible for unauthenticated attackers to view …

  26. 7.5CVE-2025-32635EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Hive Support Hive Support hive-support allows Retrieve Embedded Sensitive Data.This issue affects Hive Support: from n/a through <= 1.2.6.

  27. 7.5CVE-2025-32594EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue affects Simple WP Events: from n/a through <= 1.8.17.

  28. 4.9CVE-2025-26335EPSS 0.3%

    Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading…

  29. 5.9CVE-2025-27244EPSS 0.5%

    AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be obtained by a remote unauthenticated attacker.

  30. 5.3CVE-2025-31842EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Sensitive Data.This issue affects Viral Loops WP Integration: from n/a through <= …

  31. 6.5CVE-2025-27001EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Shipmondo – A comp…

  32. 5.3CVE-2025-30609EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.3.

  33. 5.1CVE-2025-2565EPSS 0.3%

    The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through up…

  34. 7.6CVE-2024-7872EPSS 0.2%

    Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data. This issue affects Extreme XDS: before 3933.

  35. 5.8CVE-2025-26318EPSS 1.0%

    hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application.

  36. 6.5CVE-2025-24567EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

  37. 6.5CVE-2025-24639EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Korea for WooCommerce: from n/a through <= 1.1.11.

  38. 6.5CVE-2025-24597EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders allows Retrieve Embedded Sensitive Data.This issue affe…

  39. 8.3CVE-2025-24858EPSS 0.5%

    Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best p…

  40. 7.5CVE-2023-38013EPSS 0.3%

    IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the …

  41. 5.3CVE-2025-24582ExploitEPSS 1.0%

    Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.

  42. 7.5CVE-2025-23781EPSS 0.6%

    Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.

  43. 7.5CVE-2025-23774EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through <= 1.2.

  44. 4.3CVE-2024-45653EPSS 0.4%

    IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system.

  45. 7.5CVE-2024-50633EPSS 0.6%

    A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the pr…

  46. 3.7CVE-2024-46665EPSS 0.5%

    An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared secret via interceptin…

  47. 7.5CVE-2024-13276EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

  48. 5.3CVE-2024-13269EPSS 0.4%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.

  49. 7.5CVE-2024-13259EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

  50. 7.5CVE-2024-13254EPSS 0.5%

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.