Skip to content
OpenAdvisories

Weakness (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

Base Draft

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

How to prevent it (4 mitigations)

  1. Requirements

    Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.

  2. Implementation

    Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

  3. System Configuration

    Setup default error messages so that unexpected errors do not disclose sensitive information.

  4. Architecture and Design

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE-201

All Critical High Medium Low Exploited only Public exploit

139 results · Clear filters · Feed

  • High 7.5
    CVE-2025-23774

    WordPress WPDB to Sql plugin <= 1.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affects WPDB to Sql: from n/a through <= 1.2.

    Niket Joshi WPDB to Sql
  • High 7.5
    CVE-2024-13276

    File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

    Drupal File Entity (fieldable files)
  • High 7.5
    CVE-2024-13259

    Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

    Drupal Image Sizes drupal/image_sizes Packagist
  • High 7.5
    CVE-2024-13254

    REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018

    Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

    Drupal REST Views drupal/rest_views Packagist
  • High 7.5
    CVE-2024-56300

    WordPress Post/Page Copying Tool plugin <= 2.0.0 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through <= 2.0.0.

    wpspin Post/Page Copying Tool
  • High 7.5
    CVE-2024-53804

    WordPress WP Mailster plugin <= 1.8.16.0 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through <= 1.8.16.0.

    Brandtoss WP Mailster
  • High 7.5
    CVE-2024-49235

    WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: …

    videowhisper Contact Forms, Live Support, CRM, Video Messages
  • High 8.0
    CVE-2024-8890

    Insertion of Sensitive Information Into Sent Data vulnerability on CIRCUTOR Q-SMT

    An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions due to the fact that the device only implements the HTTP protocol. This fact prevents a secure comm…

    Circutor CIRCUTOR Q-SMT
  • High 7.3
    CVE-2024-6586 Scanner template

    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and …

    lightdash lightdash
  • High 7.5
    CVE-2024-38787

    WordPress Import and export users and customers plugin <= 1.26.8 - Sensitive Information via Imported File vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through <= 1.26.8.

    Javier Carazo Import and export users and customers
  • High 7.5
    CVE-2024-32825 Scanner template

    WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through <= 3.1.3.

    Simply Static Simply Static
  • High 7.2
    CVE-2023-6916

    Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1

    Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.

    Nozomi Networks CMC Guardian
  • High 7.7
    CVE-2024-23506

    WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through <= 0.1.0.9.

    InstaWP InstaWP Connect
  • High 7.5
    CVE-2023-49261

    Sensitive authentication-related value accessible publicly

    The "tokenKey" value used in user authorization is visible in the HTML source of the login page.

    Hongdian H8951-4G-ESP
  • High 8.5
    CVE-2023-3399

    Insertion of Sensitive Information Into Sent Data in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. It was possible for an unauthorised project or group member to rea…

    GitLab GitLab gitlab gitlab-agent Web / CMS Ubuntu
  • High 7.6
    CVE-2023-1975

    Insertion of Sensitive Information Into Sent Data in answerdev/answer

    Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8.

    answerdev answerdev/answer github.com/answerdev/answer Go
  • High 7.6
    CVE-2023-28117

    Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

    Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the se…

    getsentry sentry-python sentry-python sentry-sdk Ubuntu PyPI
  • High 7.5
    CVE-2020-8975

    ZGR TPS200 NG Information Exposure

    ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (URIs) used by the application, to access sensitive information about the system.

    ZGR ZGR TPS200 NG
  • High 8.3
    CVE-2021-26566

    Insertion of sensitive information into sent data vulnerability in synorelayd in Synology DiskStation Manager (DSM) bef…

    Synology Synology DiskStation Manager (DSM)