Skip to content
OpenAdvisories

Weakness (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries

Base Draft

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

How to prevent it (1 mitigation)

  1. Architecture and Design

    This is a complex topic. See the [REF-1492] for a good discussion of best practices.

Source: MITRE CWE-202

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • High 8.2
    CVE-2025-25205 Public exploit

    Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

    Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers ca…

    advplyr audiobookshelf