CWE-202 · Information Disclosure
Exposure of Sensitive Information Through Data Queries
44CVEs
SortMost likely exploited
44 CVEs with CWE-202 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-69200CheckphpMyFAQ - Configuration Backup Disclosurethorsten · phpMyFAQ · CVSS 7.5 · 2025-12-29 | 7.5 | 2.1% | 2025-12-29 |
| CVE-2025-25205Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matchingadvplyr · audiobookshelf · CVSS 8.2 · 2025-02-12 | 8.2 | 4.8% | 2025-02-12 |
| CVE-2021-32743Passwords used to access external services inadvertently exposed through APIIcinga · icinga2 · CVSS 8.8 · 2021-07-15 | 8.8 | 1.8% | 2021-07-15 |
| CVE-2019-19000eSOMS Cachecontrol (Pragma) HTTP HeaderABB · eSOMS · CVSS 6.5 · 2020-04-02 | 6.5 | 1.1% | 2020-04-02 |
| CVE-2022-41623WordPress ALD - AliExpress Dropshipping and Fulfillment for WooCommerce premium plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilityVillatheme · ALD - AliExpress Dropshipping and Fulfillment for WooCommerce (WordPress plugin) · CVSS 7.5 · 2022-10-14 | 7.5 | 0.9% | 2022-10-14 |
| CVE-2022-20747Cisco SD-WAN vManage Software Information Disclosure VulnerabilityCisco · Cisco SD-WAN vManage · CVSS 6.5 · 2022-04-15 | 6.5 | 0.9% | 2022-04-15 |
| CVE-2023-0785SourceCodester Best Online News Portal check_availability.php information exposureSourceCodester · Best Online News Portal · CVSS 3.7 · 2023-02-12 | 3.7 | 0.9% | 2023-02-12 |
| CVE-2022-20810Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family SNMP Information Disclosure VulnerabilityCisco · Cisco IOS XE Software · CVSS 6.5 · 2022-09-30 | 6.5 | 0.8% | 2022-09-30 |
| CVE-2021-34782Cisco DNA Center Information Disclosure VulnerabilityCisco · Cisco Digital Network Architecture Center (DNA Center) · CVSS 4.3 · 2021-10-06 | 4.3 | 0.8% | 2021-10-06 |
| CVE-2019-19091ABB eSOMS: HTTP response information leakageABB · eSOMS · CVSS 4.3 · 2020-04-02 | 4.3 | 0.8% | 2020-04-02 |
| CVE-2025-59352Dragonfly allows arbitrary file read and write on a peer machinedragonflyoss · dragonfly · CVSS 6.9 · 2025-09-17 | 6.9 | 0.7% | 2025-09-17 |
| CVE-2023-1625Information leak in apiOpenstack · openstack-heat · CVSS 7.4 · 2023-09-24 | 7.4 | 0.7% | 2023-09-24 |
| CVE-2023-20215A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allow…Cisco · Cisco Secure Web Appliance · CVSS 5.8 · 2023-08-03 | 5.8 | 0.6% | 2023-08-03 |
| CVE-2023-7072Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpointpickplugins · Post Grid · CVSS 7.5 · 2024-03-12 | 7.5 | 0.6% | 2024-03-12 |
| CVE-2026-30778Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.Apache Software Foundation · Apache SkyWalking · CVSS 7.5 · 2026-04-15 | 7.5 | 0.6% | 2026-04-15 |
| CVE-2026-16520Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.…Genians · Genian NAC V4.0 · CVSS 8.7 · 2026-08-20 | 8.7 | 0.5% | 2026-08-20 |
| CVE-2024-20388A vulnerability in the password change feature of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to determine valid user names on…Cisco · Cisco Firepower Management Center · CVSS 5.3 · 2024-10-23 | 5.3 | 0.5% | 2024-10-23 |
| CVE-2026-40245Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authenticationfree5gc · free5gc · CVSS 7.5 · 2026-04-15 | 7.5 | 0.5% | 2026-04-15 |
| CVE-2024-13255RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019Drupal · RESTful Web Services · CVSS 7.5 · 2025-01-09 | 7.5 | 0.5% | 2025-01-09 |
| CVE-2026-42797Apache Syncope: JexlContextBuilder Information DisclosureApache Software Foundation · Apache Syncope · CVSS 4.9 · 2026-05-25 | 4.9 | 0.4% | 2026-05-25 |
| CVE-2021-1372Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure VulnerabilityCisco · Cisco Webex Productivity Tools · CVSS 5.5 · 2021-02-17 | 5.5 | 0.4% | 2021-02-17 |
| CVE-2024-38897WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information.Wavlink · Wn551k1 Firmware · CVSS 5.3 · 2024-06-24 | 5.3 | 0.4% | 2024-06-24 |
| CVE-2026-25050Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyvendurehq · vendure · CVSS 2.7 · 2026-01-30 | 2.7 | 0.4% | 2026-01-30 |
| CVE-2025-29981Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote ac…Dell · Wyse Management Suite · CVSS 7.5 · 2025-04-02 | 7.5 | 0.4% | 2025-04-02 |
| CVE-2024-38895WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information.Wavlink · Wn551k1 Firmware · CVSS 5.3 · 2024-06-24 | 5.3 | 0.4% | 2024-06-24 |
| CVE-2024-38892An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component.Wavlink · Wn551k1 Firmware · CVSS 6.5 · 2024-06-24 | 6.5 | 0.4% | 2024-06-24 |
| CVE-2026-77883Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylistApache Software Foundation · Apache Syncope · CVSS 4.9 · 2026-09-14 | 4.9 | 0.4% | 2026-09-14 |
| CVE-2026-40533An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2…Synology · DiskStation Manager (DSM) · CVSS 5.3 · 2026-09-18 | 5.3 | 0.4% | 2026-09-18 |
| CVE-2025-36575Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated attacker with remote acc…Dell · Wyse Management Suite · CVSS 7.5 · 2025-06-10 | 7.5 | 0.4% | 2025-06-10 |
| CVE-2024-2088NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposurenextscripts · NextScripts: Social Networks Auto-Poster · CVSS 8.5 · 2024-05-22 | 8.5 | 0.3% | 2024-05-22 |
| CVE-2025-64504Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIslangfuse · langfuse · CVSS 5 · 2025-11-10 | 5.0 | 0.3% | 2025-11-10 |
| CVE-2026-79633Apache Answer: Missing Authorization Allows Mutations of Non-Public ContentApache Software Foundation · Apache Answer · CVSS 8.1 · 2026-10-19 | 8.1 | 0.3% | 2026-10-19 |
| CVE-2025-64528Users are able to find users by name even when `enable_names` is offdiscourse · discourse · CVSS 6.3 · 2025-12-30 | 6.3 | 0.3% | 2025-12-30 |
| CVE-2026-103440pagetriagelist discloses suppressed reviewer usernamesThe Wikimedia Foundation · MediaWiki PageTriage extension · CVSS 1.2 · 2026-09-30 | 1.2 | 0.3% | 2026-09-30 |
| CVE-2026-79613Apache Answer: Disclosure of Comments on Non-Public Content Through Public ProfilesApache Software Foundation · Apache Answer · CVSS 5.3 · 2026-10-19 | 5.3 | 0.3% | 2026-10-19 |
| CVE-2021-4159A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker wi…Linux · kernel · 2022-08-24 | – | 0.2% | 2022-08-24 |
| CVE-2026-3546e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Actionforfront · e-shot · CVSS 5.3 · 2026-03-21 | 5.3 | 0.2% | 2026-03-21 |
| CVE-2026-79620Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question MetadataApache Software Foundation · Apache Answer · CVSS 4.3 · 2026-10-19 | 4.3 | 0.2% | 2026-10-19 |
| CVE-2026-106506Backstage: Improper input validation in scaffolder task list orderingbackstage · backstage · CVSS 5.3 · 2026-10-06 | 5.3 | 0.2% | 2026-10-06 |
| CVE-2026-33530InvenTree Vulnerable to ORM Filter Injectioninventree · InvenTree · CVSS 7.7 · 2026-03-26 | 7.7 | 0.2% | 2026-03-26 |
| CVE-2026-118544Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259Drupal · Commerce Core · CVSS 3.7 · 2026-10-30 | 3.7 | 0.2% | 2026-10-30 |
| CVE-2026-110183PostgreSQL Anonymizer: statistics can expose some of the original data after statistic maskingDALIBO · PostgreSQL Anonymizer · CVSS 4.3 · 2026-10-28 | 4.3 | 0.2% | 2026-10-28 |
| CVE-2026-100420Information disclosure vulnerability in the cloud-client daemon of Deco BE63TP-Link Systems Inc. · Deco BE63 V2.0 · CVSS 6.8 · 2026-10-21 | 6.8 | 0.2% | 2026-10-21 |
| CVE-2026-105615PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_statsDALIBO · PostgreSQL Anonymizer · CVSS 3.5 · 2026-10-28 | 3.5 | 0.1% | 2026-10-28 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.