CWE-540 Inclusion of Sensitive Information in Source Code
baseSource code on a web server or repository often contains sensitive information and should generally not be accessible to users.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (38)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10849US | high7.5OT elevated | Exploit | ||
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. | ||||
| CVE-2024-38327US | critical9.8 | — | ||
IBM Analytics Content Hub 2.0, 2.1, 2.2, and 2.3 is vulnerable to information exposure and further attacks due to an exposed JavaScript source map which could assist an attacker to… | ||||
| CVE-2025-49182US | critical9.8 | — | ||
Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application. | ||||
| CVE-2024-8417US | high8.1 | — | ||
A vulnerability was found in 云课网络科技有限公司 Yunke Online School System up to 1.5.5. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/educ… | ||||
| CVE-2024-38647US | high7.5 | — | ||
An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow remote attackers to compromise the security… | ||||
| CVE-2024-2265US | high7.5 | — | ||
A vulnerability, which was classified as problematic, was found in keerti1924 PHP-MYSQL-User-Login-System 1.0. This affects an unknown part of the file login.sql. The manipulation… | ||||
| CVE-2021-34638US | medium6.5 | — | ||
Authenticated Directory Traversal in WordPress Download Manager <= 3.1.24 allows authenticated (Contributor+) users to obtain sensitive configuration file information, as well as a… | ||||
| CVE-2021-1516US | medium6.5 | — | ||
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA), Cisco Email Security Appliance (ESA), and Cis… | ||||
| CVE-2023-39250US | medium5.5 | — | ||
Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manager for VMware (RMSV) versions prior to 3… | ||||
| CVE-2021-34757US | medium5.5OT elevated | — | ||
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfi… | ||||
| CVE-2021-28805US | medium5.5 | — | ||
Inclusion of sensitive information in the source code has been reported to affect certain QNAP switches running QSS. If exploited, this vulnerability allows attackers to read appli… | ||||
| CVE-2024-55907US | medium5.3 | — | ||
IBM Cognos Analytics Mobile 1.1 for iOS application could allow an attacker to reverse engineer the codebase to gain knowledge about the programming technique, interface, class def… | ||||
| CVE-2024-9596US | medium5.3 | — | ||
An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for a… | ||||
| CVE-2023-30802US | medium5.3 | — | ||
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source co… | ||||
| CVE-2023-23448US | medium5.3 | — | ||
Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a
remote attack… | ||||
| CVE-2021-34744US | medium4.9OT elevated | — | ||
Multiple vulnerabilities in Cisco Business 220 Series Smart Switches firmware could allow an attacker with Administrator privileges to access sensitive login credentials or reconfi… | ||||
| CVE-2023-35013US | medium4.4 | — | ||
IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 257769. | ||||
| CVE-2024-39729US | medium4.3 | — | ||
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow an authenticated user to obtain sensitive information from source code that could be used in further attacks… | ||||
| CVE-2026-101265US | low3.1 | — | ||
A vulnerability was identified in Intelbras TIP 125i 4.3.35/4.3.41. The affected element is an unknown function of the component Básico Page. Such manipulation leads to inclusion o… | ||||
| CVE-2026-103097US | —OT elevated | — | ||
An API key is
hardcoded and retrievable from the application package. Since Android
applications can be reverse engineered, embedding sensitive API credentials
directly in the clie… | ||||
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan