CWE-201 · Insertion of Sensitive Information into Sent Data (page 4)
Page 4 of 5 — CVEs classified under CWE-201, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48381 | Medium | 4.3 | 2025-05-30 | Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0… |
CVE-2025-48045 | | 2025-05-29 | An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials. | |
CVE-2025-48749 | Critical | 9.1 | 2025-05-28 | Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Information into Sent Data. |
CVE-2025-39498 | Medium | 5.3 | 2025-05-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-47541 | High | 7.5 | 2025-05-23 | Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mai… |
CVE-2025-48219 | Low | 3.5 | 2025-05-18 | O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multimedia Subsystem) call and then reading t… |
CVE-2025-47775 | Medium | 6.2 | 2025-05-14 | Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfilt… |
CVE-2025-3529 | High | 8.2 | 2025-04-23 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.2 via the 'fi… |
CVE-2025-32635 | High | 7.5 | 2025-04-17 | Insertion of Sensitive Information Into Sent Data vulnerability in Hive Support Hive Support hive-support allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2025-32594 | High | 7.5 | 2025-04-17 | Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-26335 | Medium | 5.8 | 2025-04-11 | Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged a… |
CVE-2025-27244 | Medium | 5.9 | 2025-04-02 | AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be… |
CVE-2025-31842 | Medium | 5.3 | 2025-04-01 | Insertion of Sensitive Information Into Sent Data vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Retrieve Embedded Se… |
CVE-2025-27001 | Medium | 6.5 | 2025-03-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Shipmondo Shipmondo – A complete shipping solution for WooCommerce pakkelabels-for-woocommer… |
CVE-2025-30609 | Medium | 5.3 | 2025-03-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-2565 | Medium | 4.3 | 2025-03-20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.1… |
CVE-2024-7872 | High | 7.6 | 2025-03-06 | Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data. This issue affects Extreme… |
CVE-2025-26318 | Medium | 5.8 | 2025-03-04 | hb.exe in TSplus Remote Access before 17.30 2024-10-30 allows remote attackers to retrieve a list of all domain accounts currently connected to the application. |
CVE-2025-24567 | Medium | 6.5 | 2025-02-14 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-24639 | Medium | 6.5 | 2025-02-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Greys Korea for WooCommerce korea-for-woocommerce allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-24597 | Medium | 6.5 | 2025-01-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-… |
CVE-2025-24858 | | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the s… | |
CVE-2023-38013 | Medium | 5.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensit… |
CVE-2025-24582 | Medium | 5.3 | 2025-01-24 | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive… |
CVE-2025-23781 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensit… |
CVE-2025-23774 | High | 7.5 | 2025-01-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Niket Joshi WPDB to Sql wpdb-to-sql allows Retrieve Embedded Sensitive Data.This issue affec… |
CVE-2024-45653 | Medium | 4.3 | 2025-01-19 | IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could… |
CVE-2024-50633 | Unrated | | 2025-01-16 | A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the… |
CVE-2024-46665 | Low | 3.7 | 2025-01-14 | An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle… |
CVE-2024-13276 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity… |
CVE-2024-13269 | Medium | 5.3 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0… |
CVE-2024-13259 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 befor… |
CVE-2024-13254 | High | 7.5 | 2025-01-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before… |
CVE-2025-22303 | Medium | 5.3 | 2025-01-07 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2024-56300 | High | 7.5 | 2025-01-07 | Insertion of Sensitive Information Into Sent Data vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies allows Re… |
CVE-2024-8429 | Medium | 4.3 | 2024-12-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials. This… |
CVE-2024-54309 | Medium | 6.5 | 2024-12-13 | Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox postbox-email-logs allows Retrieve Embedded Sensitive Data.This issue aff… |
CVE-2024-53804 | High | 7.5 | 2024-12-06 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2021-1425 | Medium | 4.3 | 2024-11-18 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an… |
CVE-2024-3502 | High | 8.1 | 2024-11-14 | In lunary-ai/lunary versions up to and including 1.2.5, an information disclosure vulnerability exists where account recovery hashes of users are inadvertently… |
CVE-2024-50378 | Medium | 4.9 | 2024-11-08 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2024-49235 | High | 7.5 | 2024-10-17 | Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Re… |
CVE-2024-6747 | Medium | 5.3 | 2024-10-10 | Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 (EOL) allows attacker to get potentially sensitive data |
CVE-2024-47128 | Medium | 4.3 | 2024-09-26 | The goTenna Pro App encryption key name is always sent unencrypted when the key is shared over RF through a broadcast message. It is advised to share the enc… |
CVE-2024-43814 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin's default settings are to share Automatic Position, Location, and Information (PLI) updates every 60 seconds once the plugin is a… |
CVE-2024-41931 | Medium | 4.3 | 2024-09-26 | The goTenna Pro ATAK Plugin encryption key name is always sent unencrypted when the key is sent over RF through a broadcast message. It is advised to share t… |
CVE-2024-8890 | High | 8.0 | 2024-09-18 | An attacker with access to the network where the CIRCUTOR Q-SMT is located in its firmware version 1.0.4, could obtain legitimate credentials or steal sessions… |
CVE-2024-7698 | Medium | 5.7 | 2024-09-10 | A low privileged remote attacker can get access to CSRF tokens of higher privileged users which can be abused to mount CSRF attacks. |
CVE-2024-6586 | High | 7.3 | 2024-08-30 | Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that conta… |
CVE-2024-43264 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in mischiefmarmot Create by Mediavine mediavine-create.This issue affects Create by Mediavine… |
CVE-2024-43259 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in WebFactory Order Export for WooCommerce order-export-and-more-for-woocommerce.This issue aff… |
CVE-2024-43230 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <=… |
CVE-2024-43283 | Medium | 5.3 | 2024-08-26 | Insertion of Sensitive Information Into Sent Data vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affec… |
CVE-2024-38787 | High | 7.5 | 2024-08-13 | Insertion of Sensitive Information Into Sent Data vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This iss… |
CVE-2024-31200 | Medium | 4.2 | 2024-07-31 | A “CWE-201: Insertion of Sensitive Information Into Sent Data” affecting the administrative account allows an attacker with physical access to the machine to r… |
CVE-2024-7205 | | 2024-07-31 | When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take over devices as primary user via shari… | |
CVE-2024-38372 | Low | 2.0 | 2024-07-08 | Undici is an HTTP/1.1 client, written from scratch for Node.js. Depending on network and process conditions of a `fetch()` request, `response.arrayBuffer()` mi… |
CVE-2024-39315 | Medium | 5.7 | 2024-07-02 | Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page (at `/.pomerium`) unintentionally included seriali… |
CVE-2024-5213 | Medium | 6.5 | 2024-06-20 | In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after l… |
CVE-2024-37881 | Medium | 5.3 | 2024-06-19 | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs… |
CVE-2024-35189 | Medium | 6.5 | 2024-05-30 | Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their a… |
CVE-2024-34812 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in RadiusTheme ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder.This issue affect… |
CVE-2024-34556 | Medium | 5.3 | 2024-05-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-sca… |
CVE-2024-4536 | Medium | 6.8 | 2024-05-07 | In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an attacker might obt… |
CVE-2024-32825 | High | 7.5 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Simply Static Simply Static simply-static.This issue affects Simply Static: from n/a through… |
CVE-2024-32796 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Jack Arturo WP Fusion Lite wp-fusion-lite allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2024-32782 | Medium | 4.3 | 2024-04-24 | Insertion of Sensitive Information Into Sent Data vulnerability in DevItems HT Mega ht-mega-for-elementor.This issue affects HT Mega: from n/a through <= 2.4.7. |
CVE-2024-32028 | Medium | 4.1 | 2024-04-12 | OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCor… |
CVE-2024-31278 | Medium | 4.3 | 2024-04-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor.This issue affects Premium… |
CVE-2023-6916 | High | 7.2 | 2024-04-10 | Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation. |
CVE-2024-28173 | Medium | 4.3 | 2024-03-06 | In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed |
CVE-2024-1435 | Medium | 5.3 | 2024-02-29 | Insertion of Sensitive Information Into Sent Data vulnerability in tainacan Tainacan tainacan.This issue affects Tainacan: from n/a through <= 0.20.6. |
CVE-2024-26270 | Medium | 6.5 | 2024-02-20 | The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 embeds the user’s h… |
CVE-2024-25150 | Medium | 4.3 | 2024-02-20 | Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before upd… |
CVE-2024-25148 | Medium | 5.4 | 2024-02-08 | In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported… |
CVE-2024-23506 | High | 7.7 | 2024-01-27 | Insertion of Sensitive Information Into Sent Data vulnerability in InstaWP InstaWP Connect instawp-connect.This issue affects InstaWP Connect: from n/a through… |
CVE-2023-49261 | High | 7.5 | 2024-01-12 | The "tokenKey" value used in user authorization is visible in the HTML source of the login page. |
CVE-2023-49594 | Medium | 4.5 | 2023-12-23 | An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted H… |
CVE-2023-3949 | Medium | 5.3 | 2023-12-01 | An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions sta… |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-3399 | High | 8.5 | 2023-11-06 | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2023-5831 | Low | 3.7 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all ve… |
CVE-2023-32275 | Medium | 5.5 | 2023-10-12 | An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. Specially crafted network packets… |
CVE-2023-3413 | Medium | 6.5 | 2023-09-29 | An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions sta… |
CVE-2023-4378 | Medium | 5.5 | 2023-09-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versio… |
CVE-2023-4002 | Medium | 5.3 | 2023-08-04 | An issue has been discovered in GitLab EE affecting all versions starting from 14.1 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-1401 | Medium | 5.0 | 2023-07-26 | An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies… |
CVE-2023-3102 | Medium | 5.3 | 2023-07-21 | A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 be… |
CVE-2023-34968 | Medium | 5.3 | 2023-07-20 | A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and dire… |
CVE-2023-3299 | Low | 3.4 | 2023-07-20 | HashiCorp Nomad Enterprise 1.2.11 up to 1.5.6, and 1.4.10 ACL policies using a block without a label generates unexpected results. Fixed in 1.6.0, 1.5.7, and 1… |
CVE-2023-2620 | Medium | 5.5 | 2023-07-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions… |
CVE-2023-1825 | Low | 3.1 | 2023-06-07 | An issue has been discovered in GitLab EE affecting all versions starting from 15.7 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versio… |
CVE-2023-1975 | Medium | 6.5 | 2023-04-11 | Insertion of Sensitive Information Into Sent Data in GitHub repository answerdev/answer prior to 1.0.8. |
CVE-2023-28117 | High | 7.6 | 2023-03-22 | Sentry SDK is the official Python SDK for Sentry, real-time crash reporting software. When using the Django integration of versions prior to 1.14.0 of the Sent… |
CVE-2022-45428 | Low | 2.7 | 2022-12-27 | Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific cr… |
CVE-2022-23488 | Medium | 6.5 | 2022-12-17 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The mo… |
CVE-2020-8975 | High | 7.5 | 2022-10-17 | ZGR TPS200 NG in its 2.00 firmware version and 1.01 hardware version, allows a remote attacker with access to the web application and knowledge of the routes (… |
CVE-2020-27784 | Medium | 5.5 | 2022-09-01 | A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of a printer_dev insta… |
CVE-2022-28224 | Medium | 5.5 | 2022-06-06 | Clusters using Calico (version 3.22.1 and below), Calico Enterprise (version 3.12.0 and below), may be vulnerable to route hijacking with the floating IP featu… |
CVE-2022-27779 | Medium | 5.3 | 2022-06-02 | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cook… |