CWE-202 Exposure of Sensitive Information Through Data Queries
Description
When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-202 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-vwp5-f99x-x3rq | CVE-2026-106506 | MODERATE |
Backstage has improper input validation in scaffolder task list ordering |
2026-10-07 | |
| GHSA-fr6g-7cq8-fg82 | CVE-2026-70473 | HIGH |
Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history |
2026-08-04 | |
| GHSA-vr35-jm2f-8wg2 | CVE-2026-42797 | MODERATE |
Apache Syncope Vulnerable to Exposure of Sensitive Information Through Data Queries |
2026-06-30 | |
| GHSA-6497-prx7-gpmq | CVE-2025-69662 | HIGH |
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure |
2026-06-05 | |
| GHSA-27h3-crw2-q36w | CVE-2026-30778 | HIGH |
SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information |
2026-04-16 | |
| GHSA-wrwh-rpq4-87hf | CVE-2026-40245 | HIGH |
free5gc UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication |
2026-04-16 | |
| GHSA-6f65-4fv2-wwch | CVE-2026-25050 | LOW |
Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy |
2026-01-30 | |
| GHSA-v64r-7wg9-23pr | CVE-2025-68456 | HIGH | - |
Unauthenticated Craft CMS users can trigger a database backup |
2026-01-09 |
| GHSA-54jq-c3m8-4m76 | CVE-2025-69226 | LOW |
AIOHTTP vulnerable to brute-force leak of internal static file path components |
2026-01-06 | |
| GHSA-9cg9-4h4f-j6fg | CVE-2025-69200 | HIGH | - |
phpMyFAQ has unauthenticated config backup download via /api/setup/backup |
2025-12-30 |
| GHSA-79hx-3fp8-hj66 | CVE-2025-59352 | MODERATE |
DragonFly vulnerable to arbitrary file read and write on a peer machine |
2025-09-26 | |
| GHSA-h27m-3qw8-3pw8 | CVE-2025-30086 | MODERATE |
Possible ORM Leak Vulnerability in the Harbor |
2025-07-25 | |
| GHSA-f2vv-h5x4-57gr | - | CRITICAL | - |
Leak of information via Store-API |
2021-10-05 |