CWE-538 · Information Disclosure
Insertion of Sensitive Information into Externally-Accessible File or Directory
107CVEs
0exploited
2with a public check
1likely (EPSS 10%+)
SortMost likely exploited
107 CVEs with CWE-538 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2024-51977CheckBrother MFC-L9570CDW - Information DisclosureBrother Industries, Ltd · HL-L8260CDN · CVSS 5.3 · 2025-06-25 | 5.3 | 47% | 2025-06-25 |
| CVE-2023-5003CheckActive Directory Integration WP Plugin < 4.1.10 - Log DisclosureMiniorange · Active Directory Integration / LDAP Integration · CVSS 7.5 · 2023-10-16 | 7.5 | 27% | 2023-10-16 |
| CVE-2019-6851A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause…Schneider-Electric · Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware ver… · 2019-10-29 | – | 29% | 2019-10-29 |
| CVE-2017-9947A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability could allow a remot…Siemens · APOGEE PXC and TALON TC BACnet Automation Controllers All versions <V3.5 · CVSS 5.3 · 2017-10-23 | 5.3 | 8.2% | 2017-10-23 |
| CVE-2018-11798The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to acc…Apache Software Foundation · Apache Thrift · 2019-01-07 | – | 4.7% | 2019-01-07 |
| CVE-2017-16770File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 allows remote authentic…Synology · Surveillance Station · 2018-02-27 | – | 1.8% | 2018-02-27 |
| CVE-2019-7618A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to read arbitrary file…Elastic · Elastic Code · 2019-10-01 | – | 1.5% | 2019-10-01 |
| CVE-2014-0772Advantech WebAccess File and Directory Information ExposureAdvantech · WebAccess · CVSS 5 · 2014-04-12 | 5.0 | 1.4% | 2014-04-12 |
| CVE-2014-0771Advantech WebAccess File and Directory Information ExposureAdvantech · WebAccess · CVSS 7.5 · 2014-04-12 | 7.5 | 1.4% | 2014-04-12 |
| CVE-2016-10399Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensitive system files via…Sendio · Sendio · 2017-07-27 | – | 1.4% | 2017-07-27 |
| CVE-2025-27017Apache NiFi: Potential Insertion of MongoDB Password in Provenance RecordApache Software Foundation · Apache NiFi · CVSS 6.9 · 2025-03-12 | 6.9 | 1.3% | 2025-03-12 |
| CVE-2019-12623Cisco Enterprise Network Functions Virtualization Infrastructure Software File Enumeration VulnerabilityCisco · Cisco Enterprise NFV Infrastructure Software · CVSS 4.3 · 2019-08-21 | 4.3 | 1.2% | 2019-08-21 |
| CVE-2021-1406Cisco Unified Communications Manager Information Disclosure VulnerabilityCisco · Cisco Unified Communications Manager · CVSS 4.9 · 2021-04-08 | 4.9 | 1.1% | 2021-04-08 |
| CVE-2021-32822File disclosure in hbspillarjs · hbs · CVSS 4 · 2021-08-16 | 4.0 | 1.0% | 2021-08-16 |
| CVE-2019-10320Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacke…Jenkins project · Jenkins Credentials Plugin · 2019-05-21 | – | 1.0% | 2019-05-21 |
| CVE-2021-21250Post-Auth External Entity Expansion (XXE)theonedev · onedev · CVSS 7.7 · 2021-01-15 | 7.7 | 0.9% | 2021-01-15 |
| CVE-2025-11079Campcodes Farm Management System file information disclosureCampcodes · Farm Management System · CVSS 5.3 · 2025-09-27 | 5.3 | 0.9% | 2025-09-27 |
| CVE-2026-69507Microsoft Windows Search Component Information Disclosure VulnerabilityMicrosoft · Windows 11 version 23H2 · CVSS 5.7 · 2026-09-08 | 5.7 | 0.9% | 2026-09-08 |
| CVE-2025-57734In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesJetBrains · TeamCity · CVSS 4.3 · 2025-08-20 | 4.3 | 0.9% | 2025-08-20 |
| CVE-2016-20024ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege EscalationZKTeco Inc. · ZKTeco ZKTime.Net · CVSS 9.8 · 2026-03-15 | 9.8 | 0.8% | 2026-03-15 |
| CVE-2024-0191RRJ Nueva Ecija Engineer Online Portal file information disclosureRRJ · Nueva Ecija Engineer Online Portal · CVSS 5.3 · 2024-01-02 | 5.3 | 0.8% | 2024-01-02 |
| CVE-2023-28444angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backendkyubisation · angular-server-side-configuration · CVSS 9.9 · 2023-03-24 | 9.9 | 0.8% | 2023-03-24 |
| CVE-2018-16970Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified id parameter.Wisetail · Learning Management System · 2018-09-12 | – | 0.7% | 2018-09-12 |
| CVE-2023-4595Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmailBVRP Software · SLmail · CVSS 7.5 · 2023-11-23 | 7.5 | 0.7% | 2023-11-23 |
| CVE-2023-7062Advanced File Manager Shortcodes <= 2.4 - Authenticated (Contributor+) Directory TraversalAdvanced File Manager · Advanced File Manager Shortcodes · CVSS 8.8 · 2024-07-10 | 8.8 | 0.7% | 2024-07-10 |
| CVE-2018-20932cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406).Cpanel · Cpanel · 2019-08-01 | – | 0.7% | 2019-08-01 |
| CVE-2019-15793Mishandling of file-system uid/gid with namespaces in shiftfsUbuntu · Shiftfs in the Linux kernel · CVSS 6.5 · 2020-04-23 | 6.5 | 0.7% | 2020-04-23 |
| CVE-2023-4480Arbitrary File Read in Fusion File ManagerPHPFusion · PHPFusion · CVSS 5.5 · 2023-09-05 | 5.5 | 0.7% | 2023-09-05 |
| CVE-2022-44623In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settingsJetBrains · TeamCity · CVSS 6.5 · 2022-11-03 | 6.5 | 0.7% | 2022-11-03 |
| CVE-2023-4933WP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory ListingAwsm · WP Job Openings · 2023-10-16 | – | 0.7% | 2023-10-16 |
| CVE-2024-22433Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remote unauthorized unauth…Dell · Data Protection Search · CVSS 8.8 · 2024-02-01 | 8.8 | 0.6% | 2024-02-01 |
| CVE-2020-37104ASTPP 4.0.1 VoIP Billing - Database Backup DownloadASTPP · ASTPP · CVSS 7.5 · 2026-02-11 | 7.5 | 0.6% | 2026-02-11 |
| CVE-2026-19229SourceCodester Online Clothing Store Dreamweaver Metadata Files _notes file information disclosureSourceCodester · Online Clothing Store · CVSS 5.3 · 2026-08-07 | 5.3 | 0.6% | 2026-08-07 |
| CVE-2019-25706Across DR-810 ROM-0 Unauthenticated File DisclosureAcross · DR-810 · CVSS 7.5 · 2026-04-12 | 7.5 | 0.5% | 2026-04-12 |
| CVE-2024-47579Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)SAP_SE · SAP NetWeaver AS for JAVA (Adobe Document Services) · CVSS 6.8 · 2024-12-10 | 6.8 | 0.5% | 2024-12-10 |
| CVE-2021-4471TG8 Firewall Unauthenticated User Password DisclosureTG8 · TG8 Firewall · CVSS 8.7 · 2025-11-14 | 8.7 | 0.5% | 2025-11-14 |
| CVE-2026-96944Windows Storage Information Disclosure VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 5.5 · 2026-10-13 | 5.5 | 0.5% | 2026-10-13 |
| CVE-2024-6880CSRF in MegaBIPJan Syski · MegaBIP · CVSS 6.9 · 2025-01-10 | 6.9 | 0.5% | 2025-01-10 |
| CVE-2026-15574Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug defaultRed Hat · Red Hat OpenShift AI 2.25 · CVSS 7.5 · 2026-07-13 | 7.5 | 0.5% | 2026-07-13 |
| CVE-2016-15056Ubee EVW3226 Unauthenticated Backup File DisclosureUbee Interactive · Ubee EVW3226 · CVSS 8.7 · 2025-11-14 | 8.7 | 0.5% | 2025-11-14 |
| CVE-2024-47580Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)SAP_SE · SAP NetWeaver AS for JAVA (Adobe Document Services) · CVSS 6.8 · 2024-12-10 | 6.8 | 0.5% | 2024-12-10 |
| CVE-2026-23838Tandoor Recipes module allows SQLite database to be externally accessible with the default settingsNixOS · nixpkgs · CVSS 8.7 · 2026-01-19 | 8.7 | 0.5% | 2026-01-19 |
| CVE-2025-0194Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLabGitLab · GitLab · CVSS 6.5 · 2025-01-08 | 6.5 | 0.5% | 2025-01-08 |
| CVE-2026-49298Apache Airflow: JWT Token Exposure in KubernetesExecutor Command-Line ArgumentsApache Software Foundation · Apache Airflow · CVSS 8.8 · 2026-06-01 | 8.8 | 0.5% | 2026-06-01 |
| CVE-2023-46723lte-pic32-writer's sendto.txt may disclose URL and the API keypaijp · lte-pic32-writer · CVSS 8.9 · 2023-10-31 | 8.9 | 0.5% | 2023-10-31 |
| CVE-2022-26329File existence disclosue vulnerability in IDM pluginMicro Focus · NetIQ Identity Manager · CVSS 1.8 · 2023-01-24 | 1.8 | 0.5% | 2023-01-24 |
| CVE-2026-118494Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9jreviews.com · JReviews component for Joomla · CVSS 8.2 · 2026-11-05 | 8.2 | 0.5% | 2026-11-05 |
| CVE-2021-3709Apport file permission bypass through emacs byte compilation errorsCanonical · apport · CVSS 6.5 · 2021-10-01 | 6.5 | 0.5% | 2021-10-01 |
| CVE-2024-22045A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directories that are accessib…Siemens · SINEMA Remote Connect Client · CVSS 7.6 · 2024-03-12 | 7.6 | 0.4% | 2024-03-12 |
| CVE-2025-31550WordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerabilitythom4 · WP-LESS · CVSS 5.8 · 2025-04-01 | 5.8 | 0.4% | 2025-04-01 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.