CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere (page 2)
Page 2 of 4 — CVEs classified under CWE-497, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-24998 | Medium | 5.3 | 2026-02-03 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popu… |
CVE-2025-36238 | Medium | 6.0 | 2026-02-02 | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration pri… |
CVE-2023-37525 | Medium | 5.3 | 2026-01-28 | A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class… |
CVE-2025-59098 | | 2026-01-26 | The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket… | |
CVE-2026-24593 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugi… |
CVE-2026-24553 | Medium | 4.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-… |
CVE-2026-24536 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve E… |
CVE-2026-24523 | Medium | 5.3 | 2026-01-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Retriev… |
CVE-2026-24377 | Medium | 4.3 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Retr… |
CVE-2025-68046 | Medium | 6.5 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-buil… |
CVE-2025-67954 | Medium | 6.5 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Ret… |
CVE-2025-63051 | Medium | 4.3 | 2026-01-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sens… |
CVE-2025-55131 | High | 7.1 | 2026-01-20 | A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout optio… |
CVE-2020-36926 | High | 7.5 | 2026-01-16 | SmarterTrack 7922 contains an information disclosure vulnerability in the Chat Management search form that reveals agent identification details. Attackers can… |
CVE-2026-22915 | Medium | 4.3 | 2026-01-15 | An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information. |
CVE-2026-0887 | Medium | 4.3 | 2026-01-13 | Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Th… |
CVE-2026-0494 | Medium | 4.3 | 2026-01-13 | Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restri… |
CVE-2026-0853 | Medium | 5.3 | 2026-01-12 | Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the… |
CVE-2026-22537 | | 2026-01-07 | The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or val… | |
CVE-2025-31051 | Medium | 5.3 | 2026-01-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Re… |
CVE-2020-36922 | High | 7.5 | 2026-01-06 | Sony BRAVIA Digital Signage 1.7.8 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive system details thr… |
CVE-2025-34171 | Medium | 5.3 | 2026-01-02 | CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and… |
CVE-2025-9110 | High | 7.5 | 2026-01-02 | An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions… |
CVE-2025-62083 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs a… |
CVE-2025-49340 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embed… |
CVE-2025-62143 | Medium | 4.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allow… |
CVE-2025-62114 | Medium | 5.3 | 2025-12-31 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in marcelotorres Download Media Library download-media-library allows… |
CVE-2025-69026 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensit… |
CVE-2025-69025 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-68988 | Medium | 5.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Em… |
CVE-2025-36229 | Low | 3.1 | 2025-12-26 | IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers. |
CVE-2025-68943 | Medium | 5.3 | 2025-12-26 | Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. |
CVE-2025-68606 | Medium | 5.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-68576 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data… |
CVE-2025-68494 | Medium | 5.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor al… |
CVE-2025-67621 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow al… |
CVE-2025-68551 | Medium | 6.5 | 2025-12-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vikas Ratudi VPSUForm v-form allows Retrieve Embedded Sensitive Dat… |
CVE-2025-11545 | | 2025-12-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a attacker may improperly… | |
CVE-2025-62955 | Medium | 4.3 | 2025-12-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-n… |
CVE-2024-58320 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname details during authentic… |
CVE-2019-25230 | Medium | 4.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows authenticated users to view sensitive system objects through the live site widget propertie… |
CVE-2019-25228 | Medium | 5.3 | 2025-12-18 | An information disclosure vulnerability in Kentico Xperience allows attackers to leak virtual context URLs via the HTTP Referer header when users interact with… |
CVE-2025-67546 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2025-64272 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official g… |
CVE-2025-64270 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retriev… |
CVE-2025-64258 | High | 7.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embed… |
CVE-2025-49914 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows… |
CVE-2025-47319 | Medium | 6.7 | 2025-12-18 | Information disclosure while exposing internal TA-to-TA communication APIs to HLOS |
CVE-2025-34442 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files… |
CVE-2025-67948 | Medium | 4.3 | 2025-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-mark… |
CVE-2025-14712 | High | 7.5 | 2025-12-15 | Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote at… |
CVE-2025-43471 | Medium | 5.5 | 2025-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43406 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-67717 | Medium | 4.3 | 2025-12-11 | ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users… |
CVE-2025-67567 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-67565 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-67564 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conv… |
CVE-2025-67470 | Medium | 4.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allo… |
CVE-2025-63070 | Medium | 4.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded… |
CVE-2025-63058 | Medium | 4.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allow… |
CVE-2025-63013 | Medium | 4.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedde… |
CVE-2025-63009 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in yuvalo WP Google Analytics Events wp-google-analytics-events allows… |
CVE-2025-62737 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in opicron Image Cleanup image-cleanup allows Retrieve Embedded Sensit… |
CVE-2025-62735 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Joel User Spam Remover user-spam-remover allows Retrieve Embedded S… |
CVE-2025-64061 | Medium | 4.3 | 2025-11-25 | Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access control mechanisms. Any authenticated user… |
CVE-2025-36112 | Medium | 5.3 | 2025-11-24 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.1 could reveal sensitive server IP conf… |
CVE-2025-66059 | Medium | 5.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcastin… |
CVE-2025-66056 | Medium | 4.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Emb… |
CVE-2025-36160 | Medium | 5.3 | 2025-11-20 | IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system. |
CVE-2022-4985 | | 2025-11-14 | Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint. By… | |
CVE-2025-13160 | Medium | 5.3 | 2025-11-14 | IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-64267 | Medium | 4.3 | 2025-11-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultima… |
CVE-2025-27368 | Medium | 4.3 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points u… |
CVE-2025-12779 | High | 8.8 | 2025-11-05 | Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token fo… |
CVE-2024-13998 | Medium | 6.5 | 2025-11-03 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to a… |
CVE-2025-34283 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user witho… |
CVE-2024-13999 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticat… |
CVE-2024-13995 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed pa… |
CVE-2025-54459 | High | 7.5 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote at… |
CVE-2025-64228 | Medium | 4.3 | 2025-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded… |
CVE-2025-43024 | High | 7.5 | 2025-10-28 | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-62902 | Medium | 5.3 | 2025-10-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedde… |
CVE-2025-34156 | | 2025-10-23 | Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses J… | |
CVE-2025-47699 | Critical | 9.9 | 2025-10-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator… |
CVE-2025-59575 | Medium | 4.9 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system… |
CVE-2025-52752 | Medium | 6.5 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensit… |
CVE-2025-11151 | High | 8.2 | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz B… |
CVE-2025-52616 | Medium | 5.3 | 2025-10-12 | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities i… |
CVE-2025-4614 | Low | 2.7 | 2025-10-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authentic… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-59447 | Low | 2.2 | 2025-10-06 | The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log… |
CVE-2025-58585 | Medium | 5.3 | 2025-10-06 | Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering. |
CVE-2025-58583 | Medium | 5.3 | 2025-10-06 | The application provides access to a login protected H2 database for caching purposes. The username is prefilled. |
CVE-2025-58579 | Medium | 5.3 | 2025-10-06 | Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enum… |
CVE-2025-60167 | Medium | 4.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows… |
CVE-2025-60119 | Medium | 5.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embed… |
CVE-2025-60092 | Medium | 5.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded… |
CVE-2025-59582 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedde… |
CVE-2025-58015 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Da… |