Skip to content
OpenAdvisories

Weakness (CWE)

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Base Incomplete

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

How to prevent it (1 mitigation)

  1. Architecture and Design, Implementation

    Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs

Source: MITRE CWE-497

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-55726 Public exploit

    Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

    The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device log file available in the blob storage container.

    Gardyn Gardyn Studio Firmware Gardyn Home Firmware Gardyn Cloud API
  • Medium 5.3
    CVE-2026-41459 Public exploit

    Xerte Online Toolkits Path Disclosure via /setup

    Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page…

    thexerteproject xerteonlinetoolkits
  • Medium 6.9
    CVE-2025-34171 Public exploit

    CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

    CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path par…

    IceWhale Tech CasaOS
  • Medium 6.9
    CVE-2025-34442 Public exploit

    AVideo < 20.1 System Path Disclosure via Public API

    AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

    World Wide Broadcast Network AVideo
  • Medium 5.3
    CVE-2025-55183 Public exploit EPSS 64%

    Source Code Exposure Vulnerability in React Server Components

    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-…

    Meta react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack npm
  • Medium 5.5
    CVE-2025-2598 Public exploit

    AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

    When the AWS Cloud Development Kit (AWS CDK) Command Line Interface (AWS CDK CLI) is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this iss…

    AWS Cloud Development Kit Command Line Interface aws-cdk cdk npm
  • Medium 5.3
    CVE-2024-45440 Public exploit

    Drupal Full Path Disclosure

    core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

    Drupal Drupal core drupal/core drupal/drupal Web / CMS Ubuntu Packagist
  • Medium 6.3
    CVE-2024-5735 Public exploit

    Full Path Disclosure in AdmirorFrames Joomla! Extension

    Full Path Disclosure vulnerability in AdmirorFrames Joomla! extension in afHelper.php script allows an unauthorised attacker to retrieve location of web root folder. This issue affects AdmirorFrames: before 5.0.

    Nikola Vasilijevski AdmirorFrames
  • Medium 5.5
    CVE-2021-31955 Exploited Public exploit EPSS 81%

    Windows Kernel Information Disclosure Vulnerability

    Windows Kernel Information Disclosure Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
    KEV Nov 3, 2021