CWE-525: Use of Web Browser Cache Containing Sensitive Information
Filter
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
What the weakness is: CWE-525 at MITRE. OWASP Top 10: A06:2025 Insecure Design
Related attack patterns (CAPEC): 1
- CAPEC-37 Retrieve Embedded Sensitive Data Likelihood: High · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-525, as MITRE names them. Credits.
Ask an AI about CWE-525
Show the prompt
Explain CWE-525: Use of Web Browser Cache Containing Sensitive Information and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/525.html and https://cve.bz/cve/cwe/525?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- –CVE-2026-118571EPSS 0.1%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2…
- –CVE-2026-118550EPSS 0.2%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) version…
- –CVE-2026-114548EPSS 0.1%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.…
- –CVE-2026-114546EPSS 0.1%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2…
- –CVE-2026-114542EPSS 0.1%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Simple OAuth (OAuth2) & Op…
- 3.1CVE-2026-96369EPSS 0.2%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3…
- 5.4CVE-2026-87940EPSS 0.2%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
- 3.3CVE-2026-4405EPSS 0.1%
IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system.
- 9.1CVE-2026-13697EPSS 0.6%
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an emp…
- 4.3CVE-2024-23571EPSS 0.3%
HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses i…
- 5.9CVE-2026-41918EPSS 0.2%
A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V4.0). The affected applications stores sensitive information in the browser cache when an authenticated user modify specific configurations. This co…
- 5.3CVE-2026-41322EPSS 0.3%
@astrojs/node allows Astro to deploy your SSR site to Node targets. Prior to 10.0.5, requesting a static js/css resources from _astro path with an incorrect/malformed if-match header returns a 500 error with a one year cache lifetime inste…
- 6.0CVE-2025-15554EPSS 0.2%
Browser caching of LAPS passwords in Truesec’s LAPSWebUI before version 2.4 allows an attacker with access to a workstation to escalate their privileges via disclosure of local admin passwords.
- 3.3CVE-2025-36364EPSS 0.1%
IBM DevOps Plan 3.0.0 through 3.0.5 allows web page cache to be stored locally which can be read by another user on the system.
- 7.1CVE-2026-27514EPSS 0.3%
Shenzhen Tenda F3 Wireless Router firmware V12.01.01.55_multi contains a sensitive information exposure vulnerability in the configuration download functionality. The configuration download response includes the router password and adminis…
- 4.8CVE-2026-24437EPSS 0.2%
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives. As a result, browsers may store credential-bearing responses locally, expos…
- 7.5CVE-2025-52659EPSS 0.2%
HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially resulting in unauthorized access or information disclosure.
- 3.7CVE-2025-13083EPSS 0.3%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 bef…
- 4.6CVE-2025-62276EPSS 0.1%
The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older …
- 7.5CVE-2025-52625EPSS 0.2%
A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affe…
- 3.3CVE-2025-36082EPSS 0.1%
IBM OpenPages 9.0 and 9.1 allows web page cache to be stored locally which can be read by another user on the system.
- 4.0CVE-2025-1348EPSS 0.1%
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allow a local user to obtain sensitive information from a user’s web browser cache due to not using a suitable caching poli…
- 7.7CVE-2025-48947EPSS 0.4%
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, `__session` cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Cont…
- 4.0CVE-2025-1334EPSS 0.2%
IBM QRadar Suite Software 1.10.12.0 through 1.11.2.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 allows web pages to be stored locally which can be read by another user on the system.
- 3.9CVE-2025-27525EPSS 0.1%
Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, fro…
- 3.3CVE-2023-43035EPSS 0.2%
IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 allows web pages to be stored locally which can be read by another user on the system.
- 6.2CVE-2024-31906EPSS 0.2%
IBM Automation Decision Services 23.0.2 allows web pages to be stored locally which can be read by another user on the system.
- 3.3CVE-2024-22349EPSS 0.2%
IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which can be read by another user on the system.
- 5.5CVE-2024-45314EPSS 0.3%
Flask-AppBuilder is an application development framework. Prior to version 4.5.1, the auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer re…
- 7.5CVE-2024-30130EPSS 0.3%
HCL Nomad server on Domino is vulnerable to the cache containing sensitive information which could potentially give an attacker the ability to acquire the sensitive information.
- 3.3CVE-2022-38383EPSS 0.2%
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Software Suite 1.10.12.0 through 1.10.21.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 233673.
- 5.5CVE-2024-25142EPSS 0.3%
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive da…
- 3.3CVE-2024-22333EPSS 0.2%
IBM Maximo Asset Management 7.6.1.3 and IBM Maximo Application Suite 8.10 and 8.11 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 279973.
- 3.3CVE-2022-43841EPSS 0.2%
IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 239078.
- 3.3CVE-2024-22343EPSS 0.2%
IBM TXSeries for Multiplatforms 8.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 280190.
- 3.3CVE-2023-46181EPSS 0.2%
IBM Sterling Secure Proxy 6.0.3 and 6.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 269686.
- 5.5CVE-2023-27545EPSS 0.2%
IBM Watson CloudPak for Data Data Stores information disclosure 4.6.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 248947.
- 3.3CVE-2023-23469EPSS 0.2%
IBM ICP4A - Automation Decision Services 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows web pages to be stored locally which can be read by another user on the syst…
- 5.5CVE-2021-42015EPSS 0.2%
A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.26), Mendix Applications using Mendix 8 (All versions < V8.18.12), Mendix Applications using Mendix 9 (All versions < V9.6.1). Applications bui…