Skip to content
OpenAdvisories

Weakness (CWE)

CWE-312: Cleartext Storage of Sensitive Information

Base Draft

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

How to prevent it (2 mitigations)

  1. Implementation, System Configuration, Operation

    When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]

  2. Implementation, System Configuration, Operation

    In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.

Source: MITRE CWE-312

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2025-65320 Public exploit

    Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in…

  • High 7.8
    CVE-2025-50777 Public exploit

    The firmware of the AZIOT 2MP Full HD Smart Wi-Fi CCTV Home Security Camera (version V1.00.02) contains an Incorrect Ac…

  • High 7.1
    CVE-2025-46820 Public exploit

    phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…

    phpgt Dom
  • High 8.6
    CVE-2025-22896 Public exploit

    mySCADA myPRO Manager Cleartext Storage of Sensitive Information

    mySCADA myPRO Manager stores credentials in cleartext, which could allow an attacker to obtain sensitive information.

    mySCADA myPRO Manager
  • High 7.2
    CVE-2023-22894 Exploited Public exploit

    Strapi leaking sensitive user information by filtering on private fields

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the …

    @strapi/strapi npm
    KEV Oct 8, 2026
  • High 7.5
    CVE-2018-8947 Public exploit EPSS 11%

    Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0

    rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

    rap2hpoutre/laravel-log-viewer Packagist