CWE-204 · Information Disclosure
Observable Response Discrepancy
217CVEs
0exploited
5with a public check
0likely (EPSS 10%+)
SortMost likely exploited
217 CVEs with CWE-204 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2022-41697CheckGhost CMS - User EnumerationGhost Foundation · Ghost · CVSS 5.3 · 2022-12-23 | 5.3 | 20% | 2022-12-23 |
| CVE-2025-62512CheckPiwigo - User Enumeration via Password ResetPiwigo · Piwigo · CVSS 5.5 · 2026-02-24 | 5.5 | 0.8% | 2026-02-24 |
| CVE-2026-21484CheckAnythingLLM - Username Enumeration via Password RecoveryMintplex-Labs · anything-llm · CVSS 5.3 · 2026-01-03 | 5.3 | 0.8% | 2026-01-03 |
| CVE-2026-28288CheckDify User Enumeration via Observable Response Discrepancylanggenius · dify · CVSS 5.5 · 2026-02-27 | 5.5 | 0.7% | 2026-02-27 |
| CVE-2026-28358CheckNocoDB - User Enumerationnocodb · nocodb · CVSS 2.7 · 2026-03-02 | 2.7 | 0.7% | 2026-03-02 |
| CVE-2016-9499The Accellion FTP server prior to version FTA_9_12_220 is vulnerable to cross-site scripting.Accellion · FTP Server · 2018-07-13 | – | 7.7% | 2018-07-13 |
| CVE-2019-19030Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls reveal (via the HTTP status code) whether…Linuxfoundation · Harbor · CVSS 5.3 · 2022-12-26 | 5.3 | 2.0% | 2022-12-26 |
| CVE-2021-20049A vulnerability in SonicWall SMA100 password change API allows a remote unauthenticated attacker to perform SMA100 username enumeration based on the server responses. This vulnera…SonicWall · SonicWall SMA100 · 2021-12-23 | – | 1.4% | 2021-12-23 |
| CVE-2022-0564Qlik Sense Enterprise Domain User enumerationQlik Sense · Qlik Sense Enterprise on Windows · CVSS 5.3 · 2022-02-21 | 5.3 | 1.4% | 2022-02-21 |
| CVE-2021-39189Observable Response Discrepancy in Lost Password Servicepimcore · pimcore · CVSS 5.3 · 2021-09-15 | 5.3 | 1.4% | 2021-09-15 |
| CVE-2020-11063Observable Response Discrepancy in TYPO3 CMSTYPO3 · TYPO3 CMS · CVSS 3.7 · 2020-05-13 | 3.7 | 1.2% | 2020-05-13 |
| CVE-2024-39211Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.No vendor recorded · CVSS 5.3 · 2024-07-04 | 5.3 | 1.1% | 2024-07-04 |
| CVE-2021-34580Remote user enumeration in mymbCONNECT24, mbCONNECT24 <= 2.9.0MB connect line · mymbCONNECT24 · CVSS 7.5 · 2021-10-27 | 7.5 | 1.0% | 2021-10-27 |
| CVE-2022-31248SUMA user enumeration via weak error messageSUSE · SUSE Manager Server 4.1 · CVSS 5.3 · 2022-06-22 | 5.3 | 1.0% | 2022-06-22 |
| CVE-2022-22520User enumeration vulnerability in MB connect line and Helmholz productsMB connect line · mymbCONNECT24 · CVSS 5.3 · 2022-09-14 | 5.3 | 1.0% | 2022-09-14 |
| CVE-2026-69519Azure Stack HCI Information Disclosure VulnerabilityMicrosoft · Azure Stack HCI · CVSS 8.6 · 2026-08-20 | 8.6 | 1.0% | 2026-08-20 |
| CVE-2025-34255D-Link Nuclias Connect <= v1.3.1.4 Forgot Password Account EnumerationD-Link · Nuclias Connect · CVSS 6.9 · 2025-10-16 | 6.9 | 1.0% | 2025-10-16 |
| CVE-2025-34254D-Link Nuclias Connect <= v1.3.1.4 Login Account EnumerationD-Link · Nuclias Connect · CVSS 6.9 · 2025-10-16 | 6.9 | 1.0% | 2025-10-16 |
| CVE-2022-1989CODESYS Visualization vulnerable to user enumerationCODESYS · CODESYS Visualization · CVSS 5.3 · 2022-08-23 | 5.3 | 0.9% | 2022-08-23 |
| CVE-2024-2482Surya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancySurya2Developer · Hostel Management Service · CVSS 3.7 · 2024-03-15 | 3.7 | 0.8% | 2024-03-15 |
| CVE-2026-66002Frappe: User Enumeration via PDDRfrappe · frappe · CVSS 6.9 · 2026-08-20 | 6.9 | 0.8% | 2026-08-20 |
| CVE-2022-39315Kirby CMS vulnerable to user enumeration in the brute force protectiongetkirby · kirby · CVSS 6.5 · 2022-10-25 | 6.5 | 0.8% | 2022-10-25 |
| CVE-2023-35698Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login att…SICK AG · ICR890-4 · CVSS 5.3 · 2023-07-10 | 5.3 | 0.8% | 2023-07-10 |
| CVE-2023-23449Observable Response Discrepancy in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain inform…SICK AG · SICK FTMG-ESD15AXX AIR FLOW SENSOR · CVSS 5.3 · 2023-05-15 | 5.3 | 0.8% | 2023-05-15 |
| CVE-2021-38476InHand Networks IR615 RouterInHand Networks · IR615 Router · CVSS 6.5 · 2021-10-19 | 6.5 | 0.8% | 2021-10-19 |
| CVE-2024-13028Antabot White-Jotter login observable response discrepancyAntabot · White-Jotter · CVSS 3.7 · 2024-12-29 | 3.7 | 0.8% | 2024-12-29 |
| CVE-2022-20633Cisco Enterprise Chat and Email Username Enumeration VulnerabilityCisco · Cisco Enterprise Chat and Email · CVSS 5.3 · 2024-11-15 | 5.3 | 0.8% | 2024-11-15 |
| CVE-2024-24766CasaOS Username EnumerationIceWhaleTech · CasaOS-UserService · CVSS 6.2 · 2024-03-06 | 6.2 | 0.8% | 2024-03-06 |
| CVE-2024-36510An observable response discrepancy vulnerability [CWE-204] in FortiClientEMS 7.4.0, 7.2.0 through 7.2.4, 7.0 all versions, and FortiSOAR 7.5.0, 7.4.0 through 7.4.4, 7.3.0 through…Fortinet · FortiClientEMS · CVSS 4.9 · 2025-01-14 | 4.9 | 0.7% | 2025-01-14 |
| CVE-2025-1101A CWE-204 "Observable Response Discrepancy" in the login page in Q-Free MaxTime less than or equal to version 2.11.0 allows an unauthenticated remote attacker to enumerate valid u…Q-Free · MaxTime · CVSS 5.3 · 2025-02-12 | 5.3 | 0.7% | 2025-02-12 |
| CVE-2024-13198langhsu Mblog Blog System login observable response discrepancylanghsu · Mblog Blog System · CVSS 3.7 · 2025-01-09 | 3.7 | 0.7% | 2025-01-09 |
| CVE-2025-23214Cosmos userbase checking vulnerabilityazukaar · Cosmos-Server · CVSS 6.9 · 2025-01-20 | 6.9 | 0.7% | 2025-01-20 |
| CVE-2024-6056nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancynasirkhan · Laravel Starter · CVSS 3.7 · 2024-06-17 | 3.7 | 0.7% | 2024-06-17 |
| CVE-2021-36201CCURE Observable Response DiscrepancyJohnson Controls · C•CURE 9000 · CVSS 4.3 · 2022-10-11 | 4.3 | 0.6% | 2022-10-11 |
| CVE-2023-1540Observable Response Discrepancy in answerdev/answeranswerdev · answerdev/answer · CVSS 5.3 · 2023-03-21 | 5.3 | 0.6% | 2023-03-21 |
| CVE-2023-38362IBM CICS TX information disclosureIBM · CICS TX Advanced · CVSS 5.3 · 2024-03-04 | 5.3 | 0.6% | 2024-03-04 |
| CVE-2023-39343Sulu Observable Response Discrepancy on Admin Loginsulu · sulu · CVSS 4.3 · 2023-08-04 | 4.3 | 0.6% | 2023-08-04 |
| CVE-2024-28232Username Enumeration in CasaOS via bypass of CVE-2024-24766IceWhaleTech · CasaOS-UserService · CVSS 6.2 · 2024-04-01 | 6.2 | 0.6% | 2024-04-01 |
| CVE-2023-3336TN-5900 Series User Enumeration VulnerabilityMoxa · TN-5900 Series · CVSS 5.3 · 2023-07-05 | 5.3 | 0.6% | 2023-07-05 |
| CVE-2023-3221User enumeration vulnerability in Roundcube Password Recovery PluginAlfnRU · Password Recovery Plugin · CVSS 5.3 · 2023-09-04 | 5.3 | 0.6% | 2023-09-04 |
| CVE-2022-39228Observable Response Discrepancy in vantage6vantage6 · vantage6 · CVSS 5.3 · 2023-03-01 | 5.3 | 0.6% | 2023-03-01 |
| CVE-2024-25146Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and older unsupported versions returns with…Liferay · Portal · CVSS 5.3 · 2024-02-08 | 5.3 | 0.6% | 2024-02-08 |
| CVE-2026-54739Lemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialLemmyNet · lemmy · CVSS 6.9 · 2026-08-19 | 6.9 | 0.6% | 2026-08-19 |
| CVE-2024-40627OpaMiddleware does not filter HTTP OPTIONS requestsbusykoala · fastapi-opa · CVSS 5.8 · 2024-07-15 | 5.8 | 0.6% | 2024-07-15 |
| CVE-2025-54834OPEXUS FOIAXpress Public Access Link (PAL) unauthenticated username enumerationOPEXUS · FOIAXpress Public Access Link (PAL) · CVSS 5.3 · 2025-07-31 | 5.3 | 0.6% | 2025-07-31 |
| CVE-2023-37831An issue discovered in Elenos ETG150 FM transmitter v3.12 allows attackers to enumerate user accounts based on server responses when credentials are submitted.Elenos · Etg150 Firmware · 2023-10-31 | – | 0.6% | 2023-10-31 |
| CVE-2023-41885Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumerationpiccolo-orm · piccolo · CVSS 5.3 · 2023-09-12 | 5.3 | 0.6% | 2023-09-12 |
| CVE-2026-60007In Eclipse Milo versions 0.6.0 through 1.1.4, username-token processing returns distinguishable errors for invalid RSA PKCS#1 v1.5 padding and other authentication failures, allow…Eclipse Foundation · Eclipse Milo · CVSS 9.1 · 2026-08-04 | 9.1 | 0.6% | 2026-08-04 |
| CVE-2023-32346Teltonika’s Remote Management System versions prior to 4.10.0 contain a function that allows users to claim their devices. This function returns information based on whether the s…Teltonika · Remote Management System · CVSS 5.3 · 2023-05-22 | 5.3 | 0.5% | 2023-05-22 |
| CVE-2025-31124Zitadel allows User Enumeration by loginname attribute normalizationzitadel · zitadel · CVSS 5.3 · 2025-03-31 | 5.3 | 0.5% | 2025-03-31 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.