CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere (page 3)
Page 3 of 5 — CVEs classified under CWE-497, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13160 | Medium | 5.3 | 2025-11-14 | IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-64267 | Medium | 4.3 | 2025-11-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPSwings WooCommerce Ultimate Points And Rewards woocommerce-ultima… |
CVE-2025-27368 | Medium | 4.3 | 2025-11-12 | IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points u… |
CVE-2025-12779 | High | 8.8 | 2025-11-05 | Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token fo… |
CVE-2024-13998 | Medium | 6.5 | 2025-11-03 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to a… |
CVE-2025-34283 | Medium | 6.5 | 2025-10-30 | Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Neptune themes. An authenticated user witho… |
CVE-2024-13999 | Critical | 9.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or LDAP authentication token to an authenticat… |
CVE-2024-13995 | High | 8.8 | 2025-10-30 | Nagios XI versions prior to 2024R1.1.2 may (confirmed in 2024R1.1 and 2024R1.1.1) disclose sensitive user account information (including API keys and hashed pa… |
CVE-2025-54459 | High | 7.5 | 2025-10-29 | Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote at… |
CVE-2025-64228 | Medium | 4.3 | 2025-10-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Retrieve Embedded… |
CVE-2025-43024 | High | 7.5 | 2025-10-28 | A GUI dialog of an application allows to view what files are in the file system without proper authorization. |
CVE-2025-62524 | Medium | 5.3 | 2025-10-27 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header… |
CVE-2025-62902 | Medium | 5.3 | 2025-10-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk WP Popup Builder wp-popup-builder allows Retrieve Embedde… |
CVE-2025-34156 | | 2025-10-23 | Tibbo AggreGate Network Manager < 6.40.05 exposes sensitive system information through an unauthenticated endpoint at /cwmp/happyaxis.jsp. The page discloses J… | |
CVE-2025-47699 | Critical | 9.9 | 2025-10-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator… |
CVE-2025-59575 | Medium | 4.9 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system… |
CVE-2025-52752 | Medium | 6.5 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensit… |
CVE-2025-11151 | High | 8.2 | 2025-10-21 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Beyaz B… |
CVE-2025-52616 | Medium | 5.3 | 2025-10-12 | HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities i… |
CVE-2025-4614 | Low | 2.7 | 2025-10-09 | An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to view session tokens of users authentic… |
CVE-2025-44823 | Critical | 9.9 | 2025-10-07 | Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_us… |
CVE-2025-59447 | Low | 2.2 | 2025-10-06 | The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log… |
CVE-2025-58585 | Medium | 5.3 | 2025-10-06 | Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering. |
CVE-2025-58583 | Medium | 5.3 | 2025-10-06 | The application provides access to a login protected H2 database for caching purposes. The username is prefilled. |
CVE-2025-58579 | Medium | 5.3 | 2025-10-06 | Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enum… |
CVE-2025-60167 | Medium | 4.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows… |
CVE-2025-60119 | Medium | 5.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embed… |
CVE-2025-60092 | Medium | 5.3 | 2025-09-26 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded… |
CVE-2025-59582 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedde… |
CVE-2025-58015 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Da… |
CVE-2025-58007 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive… |
CVE-2025-57937 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Retrieve Embedde… |
CVE-2025-57916 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Nurul Amin WP System Information wp-system-info allows Retrieve Emb… |
CVE-2025-36146 | Medium | 4.3 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks… |
CVE-2024-12367 | High | 8.6 | 2025-09-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issu… |
CVE-2025-4235 | | 2025-09-12 | An information exposure vulnerability in the Palo Alto Networks User-ID Credential Agent (Windows-based) can expose the service account password under specific… | |
CVE-2025-10264 | Critical | 10.0 | 2025-09-12 | Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remoter attackers to access the sy… |
CVE-2025-6769 | Medium | 4.3 | 2025-09-12 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.1 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed… |
CVE-2025-9364 | High | 8.8 | 2025-09-09 | An open database issue exists in the affected product and version. The security issue stems from an over permissive Redis instance. This could result in an att… |
CVE-2025-58866 | Low | 2.7 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve… |
CVE-2025-58797 | Medium | 5.3 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embed… |
CVE-2025-2667 | Low | 2.7 | 2025-09-04 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6… |
CVE-2025-36162 | Medium | 4.3 | 2025-09-02 | IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) 8.1 before 8.1.2.2 could allow an authenticated user to obtain sensitive information about configuration on the… |
CVE-2025-8700 | | 2025-08-26 | Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged… | |
CVE-2025-8597 | | 2025-08-26 | MacVim's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access… | |
CVE-2025-57888 | Medium | 5.3 | 2025-08-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NooTheme Jobmonster noo-jobmonster allows Retrieve Embedded Sensiti… |
CVE-2025-27721 | High | 7.5 | 2025-08-21 | Unauthorized users can access INFINITT PACS System Manager without proper authorization, which could lead to unauthorized access to system resources. |
CVE-2025-48355 | Medium | 5.3 | 2025-08-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ProveSource LTD ProveSource Social Proof provesource allows Retriev… |
CVE-2025-2988 | Low | 2.7 | 2025-08-19 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7, 6.2.0.0 through 6.2.0.4, and 6.2.1.0 could disclose sensitive server informa… |
CVE-2025-54736 | Medium | 5.3 | 2025-08-14 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This… |
CVE-2025-23288 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with local unprivileged… |
CVE-2025-23287 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vu… |
CVE-2025-54422 | Medium | 5.5 | 2025-07-29 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.1 and below, a critical security vul… |
CVE-2022-50237 | Medium | 5.9 | 2025-07-28 | The ed25519-dalek crate before 2 for Rust allows a double public key signing function oracle attack. The Keypair implementation leads to a simple computation f… |
CVE-2025-53031 | Medium | 5.3 | 2025-07-15 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform)… |
CVE-2024-51770 | High | 7.5 | 2025-07-14 | An information disclosure vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.17. |
CVE-2025-53862 | Low | 3.5 | 2025-07-11 | A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data… |
CVE-2025-6390 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These… |
CVE-2025-4662 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before SANnav 2.4.0a logs plaintext passphrases in the Brocade SANnav host server audit logs while executing OpenSSL command using a passphrase… |
CVE-2025-53364 | Medium | 5.3 | 2025-07-10 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse… |
CVE-2025-7381 | Medium | 5.3 | 2025-07-09 | ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By hea… |
CVE-2025-2670 | Medium | 4.3 | 2025-07-09 | IBM OpenPages 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points related t… |
CVE-2025-27369 | Medium | 4.3 | 2025-07-08 | IBM OpenPages with Watson 8.3 and 9.0 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certa… |
CVE-2025-24334 | Low | 3.3 | 2025-07-02 | The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST req… |
CVE-2025-53211 | Medium | 5.3 | 2025-06-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allo… |
CVE-2025-6561 | Critical | 9.8 | 2025-06-26 | Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remo… |
CVE-2025-49147 | Medium | 5.3 | 2025-06-24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request… |
CVE-2025-5416 | Low | 2.7 | 2025-06-20 | A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /a… |
CVE-2025-52719 | Medium | 4.3 | 2025-06-20 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communi… |
CVE-2025-4229 | | 2025-06-13 | An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent… | |
CVE-2025-0036 | Low | 3.2 | 2025-06-10 | In AMD Versal Adaptive SoC devices, the incorrect configuration of the SSS during runtime (post-boot) cryptographic operations could cause data to be incorrect… |
CVE-2025-31045 | High | 7.5 | 2025-06-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in elfsight elfsight Contact Form widget elfsight-contact-form allows… |
CVE-2025-5893 | Critical | 9.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to ac… |
CVE-2025-49419 | Medium | 5.5 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retr… |
CVE-2025-23969 | Medium | 5.3 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in whassan KI Live Video Conferences ki-live-video-conferences allows… |
CVE-2025-24473 | Low | 3.7 | 2025-05-28 | A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindo… |
CVE-2025-2236 | | 2025-05-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. Th… | |
CVE-2025-30170 | Medium | 5.5 | 2025-05-22 | Exposure of file path, file size or file existence vulnerabilities in ASPECT provide attackers access to file system information if session administrator crede… |
CVE-2025-4364 | | 2025-05-20 | The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain admin… | |
CVE-2025-39394 | Medium | 5.3 | 2025-05-19 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-32299 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress q… |
CVE-2025-31062 | Medium | 4.3 | 2025-05-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data… |
CVE-2025-48024 | Medium | 5.0 | 2025-05-15 | In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint. |
CVE-2025-30011 | Medium | 5.3 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-46747 | Medium | 5.7 | 2025-05-12 | An authenticated user without user-management permissions could identify other user accounts. |
CVE-2025-46718 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single… |
CVE-2025-46717 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine w… |
CVE-2025-3506 | Medium | 5.3 | 2025-05-08 | Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to a… |
CVE-2025-47540 | Medium | 5.3 | 2025-05-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs weMail wemail allows Retrieve Embedded Sensitive Data.This i… |
CVE-2025-3606 | High | 7.5 | 2025-04-25 | Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credenti… |
CVE-2025-46421 | Medium | 6.8 | 2025-04-24 | A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redir… |
CVE-2025-32792 | | 2025-04-18 | SES safely executes third-party JavaScript 'strict' mode programs in compartments that have no excess authority in their global scope. Prior to version 1.12.0… | |
CVE-2025-39439 | Medium | 5.3 | 2025-04-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensit… |
CVE-2025-39589 | Medium | 4.3 | 2025-04-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-ele… |
CVE-2025-39556 | Medium | 5.3 | 2025-04-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in mediavine Mediavine Control Panel mediavine-control-panel allows Re… |
CVE-2025-26730 | High | 7.5 | 2025-04-15 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NotFound Macro Calculator with Admin Email Optin & Data. This issue… |
CVE-2025-30686 | High | 7.6 | 2025-04-15 | Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: EMC). Supported versions that are affected are 1… |
CVE-2022-43852 | Medium | 5.3 | 2025-04-14 | IBM Aspera Console 3.4.0 through 3.4.4 could disclose sensitive information in HTTP headers that could be used in further attacks against the system. |
CVE-2025-32228 | Medium | 4.3 | 2025-04-10 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-gen… |
CVE-2025-31003 | Low | 2.7 | 2025-04-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitiv… |