Skip to content
OpenAdvisories

Weakness (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries

Base Draft

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

How to prevent it (1 mitigation)

  1. Architecture and Design

    This is a complex topic. See the [REF-1492] for a good discussion of best practices.

Source: MITRE CWE-202

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-118544

    Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

    Exposure of Sensitive Information Through Data Queries vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.

    Drupal Commerce Core drupal/commerce Packagist
  • Low 3.5
    CVE-2026-105615

    PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

    PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in Post…

    DALIBO PostgreSQL Anonymizer
  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm
  • Low 3.7
    CVE-2023-0785

    SourceCodester Best Online News Portal check_availability.php information exposure

    A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. Affected by this vulnerability is an unknown functionality of the file check_availability.php. The manipulation of the argument username leads to exposure of se…

    SourceCodester Best Online News Portal