Skip to content
OpenAdvisories

Weakness (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries

Base Draft

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

How to prevent it (1 mitigation)

  1. Architecture and Design

    This is a complex topic. See the [REF-1492] for a good discussion of best practices.

Source: MITRE CWE-202

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 2.7
    CVE-2026-25050 Public exploit

    Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

    Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows attackers to enumerate valid usernames (email addresses). In `packages/core/src…

    vendurehq vendure @vendure/core npm