Weakness (CWE)
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it (2 mitigations)
-
Implementation, System Configuration, Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
-
Implementation, System Configuration, Operation
In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
Source: MITRE CWE-312
18 results · Clear filters · Feed
-
Medium 6.5CVE-2026-110200 Public exploit
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.
-
High 7.5CVE-2025-65320 Public exploit
Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in…
-
Critical 9.0CVE-2025-63729 Public exploit
An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL P…
-
High 7.8CVE-2025-50777 Public exploit
The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Ac…
-
Low 2.3CVE-2025-5154 Public exploit
PhonePe App SQLite Database databases cleartext storage in file
A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The att…
-
Medium 5.5CVE-2024-56428 Public exploit
The local iLabClient database in itech iLabClient 3.7.1 allows local attackers to read cleartext credentials (from the …
-
High 7.1CVE-2025-46820 Public exploit
phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact
phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…
-
High 8.6CVE-2025-22896 Public exploit
mySCADA myPRO Manager Cleartext Storage of Sensitive Information
mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.
-
Low 2.4CVE-2024-46383 Public exploit
Hathway Skyworth Router CM5100-511 v4.1.1.24 was discovered to store sensitive information about USB and Wifi connected…
-
Critical 9.1CVE-2024-40457 Public exploit
No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. NOTE: …
-
Medium 5.5CVE-2024-24488 Public exploit
An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive informati…
-
High 7.2
Strapi leaking sensitive user information by filtering on private fields
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …
KEV Oct 8, 2026 -
Critical 9.9CVE-2021-36782 Public exploit
Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object
A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issu…
-
Medium 6.5CVE-2021-35036 Public exploit
A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allo…
-
Unscored —CVE-2020-5723 Public exploit
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an att…
-
Unscored —CVE-2016-8366 Public exploit
Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincide…
-
High 7.5
Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
-
Medium —CVE-2013-5676 Public exploit
Jenkins SonarQube Plugin Stores Passwords in Cleartext
The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.