Skip to content
OpenAdvisories

Weakness (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

Base Draft

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

How to prevent it (4 mitigations)

  1. Requirements

    Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.

  2. Implementation

    Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

  3. System Configuration

    Setup default error messages so that unexpected errors do not disclose sensitive information.

  4. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-201

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-107268 Public exploit

    Two Factor Authentication - TFA / Passwordless Login - Moderately critical - Information disclosure - SA-CONTRIB-2026-207

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, fro…

    Drupal Two Factor Authentication - TFA / Passwordless Login drupal/miniorange_2fa Packagist
  • Critical 9.8
    CVE-2026-92555 Public exploit

    Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

    Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26…

    AKIN Software Computer Import Export Industry and Trade AKINSOFT WOLVOX Control Panel
  • Critical 9.6
    CVE-2026-42880 Public exploit

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with r…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Critical 9.1
    CVE-2026-39912 Public exploit

    v2board / Xboard Authentication Token Exposure via loginWithMailLink

    V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink end…

    cedar2025 v2board v2board Xboard
  • High 8.3
    CVE-2025-58098 Public exploit

    Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

    Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2025-60188 Public exploit

    WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.

    Vito Peleg Atarim
  • Medium 5.3
    CVE-2025-58226 Public exploit

    WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery interactive-3d-flipbook-powered-physics-engine allows Retrieve Embedded Sensitive Data.This issue affects 3D FlipBook – PD…

    iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
  • Medium 5.8
    CVE-2025-26318 Public exploit

    hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain account…

    TSplus TSplus Remote Access
  • None 0.0
    CVE-2024-50633 Public exploit

    Indico Insecure Access

    A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally …

    CERN Indico indico PyPI