CWE-202 Exposure of Sensitive Information Through Data Queries
baseWhen trying to keep information confidential, an attacker can often infer some of the information by using statistics.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (53)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-59352US | critical9.8 | — | ||
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipi… | ||||
| CVE-2025-68456US | critical9.1 | — | ||
Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations… | ||||
| CVE-2021-32743US | high8.8 | — | ||
Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In versions prior to 2.11… | ||||
| CVE-2026-70473US | high8.5OT elevated | — | ||
Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns the entire server-wid… | ||||
| CVE-2026-25050US | medium5.3 | Exploit | ||
Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenticate()` method is vulnerable to a timing attack that allows… | ||||
| CVE-2024-6400US | high7.5OT elevated | — | ||
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Auth… | ||||
| CVE-2022-41623US | high7.5 | — | ||
Sensitive Data Exposure in Villatheme ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 on WordPress. | ||||
| CVE-2021-32711US | high7.5 | — | ||
Shopware is an open source eCommerce platform. Versions prior to 6.3.5.1 may leak of information via Store-API. The vulnerability could only be fixed by changing the API system, wh… | ||||
| CVE-2019-0821US | medium6.5 | — | ||
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID… | ||||
| CVE-2026-33530US | medium6.5 | — | ||
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive… | ||||
| CVE-2024-2088US | medium6.5 | — | ||
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.3 via the 'nxs_getExpSet… | ||||
| CVE-2022-20810US | medium6.5 | — | ||
A vulnerability in the Simple Network Management Protocol (SNMP) of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authenticated, remote atta… | ||||
| CVE-2022-20747US | medium6.5 | — | ||
A vulnerability in the History API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain access to sensitive information on an affected system. Thi… | ||||
| CVE-2019-19000US | medium6.5 | — | ||
For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP header(s) have not been properly configured within the application response. This can potentially allow browsers and p… | ||||
| CVE-2021-1372US | medium5.5 | — | ||
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on… | ||||
| CVE-2026-40533US | medium5.3 | — | ||
An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2… | ||||
| CVE-2025-69226US | medium5.3 | — | ||
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components… | ||||
| CVE-2025-64528US | medium5.3 | — | ||
Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name v… | ||||
| CVE-2024-20388US | medium5.3 | — | ||
A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on… | ||||
| CVE-2023-20215US | medium5.3 | — | ||
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowi… | ||||
03
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan