Weakness (CWE)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it (1 mitigation)
-
Architecture and Design
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Source: MITRE CWE-200
3,828 results · Clear filters · Feed
-
Medium 6.5
An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Ser…
-
Medium 5.3
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() …
-
Medium 5.3
WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and…
-
Medium 5.3
WWBN AVideo Broken Access Control via Channel Page
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel en…
-
Medium 4.3
Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constru…
-
Medium 5.3CVE-2026-81199 Scanner template
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assi…
-
Medium 5.3
MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning prog…
-
Medium 5.3
MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of un…
-
Medium 5.3
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in the response to its public submission handler, allowing unauthenticated users to disclose notification recipient addres…
-
Medium 5.3
Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts.
-
Medium 4.3
Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API
The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role.
-
Medium 5.3
Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comment…
-
Medium 5.3
Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content
The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing unauthenticated visitors to read the content of non-published (draft, pending, private, and trashed) Site Builder part…
-
Medium 6.5
Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak …
-
Medium 6.9
WWBN AVideo through 30.0 Information Disclosure via MobileManager
WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/…
-
Medium 4.4
Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API
A vulnerability exists in the API of HPE Networking Fabric Composer that allows for an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve sensitive information tha…
-
Medium 4.7
Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to view sensitive information. Successful exploitation could allow an attacker to retrieve informat…
-
Medium 5.6
Local Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensit…
-
Medium 5.3
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requir…
-
Medium 4.3
Information disclosure in the WebExtensions component in Firefox for Android
Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.
-
Medium 5.3
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
-
Medium 4.3
vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure
A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in inf…
-
Medium 5.3
code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure
A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The at…
-
Medium 5.3
Linux Foundation Magma InitialUEMessage information disclosure
A vulnerability was determined in Linux Foundation Magma 1.9.0. The impacted element is an unknown function of the component InitialUEMessage Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been …
-
Medium 4.9
SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independent…
-
Medium 6.5
StarRocks Query Detail Endpoint Returns Every User's Query History
StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling da…
-
Medium 5.9
SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch
SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from o…
-
Medium 6.9
WWBN AVideo through 30.0 Information Disclosure via report4.json.php
WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily an…
-
Medium 4.3
An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to …
-
Medium 5.3
WP User Frontend < 4.3.10 - Unauthenticated User Email and Phone Disclosure via User Directory
The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators.
-
Medium 6.5
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to r…
-
Medium 6.5
Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.…
-
Medium 4.3
Finale Lite < 2.21.0 - Subscriber+ Campaign Configuration Disclosure via wcct_quick_view_html
The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user (Subscriber and above) to read the Finale Lite WordPre…
-
Medium 5.3
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumeratin…
-
Medium 5.3CVE-2026-37069 Public exploit
Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Mana…
-
Medium 5.3
Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history …
-
Medium 4.3
Weblate: Restricted-component change history leaked to non-member project users through the nested `GET /api/projects/{slug}/changes/` endpoint
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change history of restricted components in that project through nested A…
-
Medium 6.5
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) allowed an authenticated user with the lowest-privilege Observer role t…
-
Medium 6.5
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extrac…
-
Medium 6.5
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent…