Weaknesses of type CWE-1336

301 results

Divulgação de Informações

É quando a aplicação expõe dados sensíveis (senhas, tokens, chaves, dados pessoais, caminhos internos) para quem não deveria acessá-los. Pode acontecer por erro de configuração, logs verbosos, mensagens de erro detalhadas, ou armazenamento inadequado. O risco é que um atacante consiga informações que facilitem outros ataques.

Example

Um servidor Node.js em produção deixando debug mode ativo, que retorna stack traces completos nas respostas de erro (incluindo caminhos absolutos e variáveis de ambiente), ou um endpoint de recuperação de senha que retorna 'email encontrado' vs 'email não encontrado', revelando quais usuários existem no sistema.

How to mitigate

Desabilite modo debug/verbose em produção; sanitize mensagens de erro para consumidor final (log detalhes internamente, não exponha ao usuário); remova metadados sensíveis de respostas HTTP; aplique princípio do menor privilégio em configurações de acesso a arquivos; nunca exporte credenciais ou chaves em logs ou comentários de código.

CVE-2026-61707CRITICALSOCFortress CoPilot: Stored case-report template injection permits backend code executionEPSS 0.2%CVE-2026-57170HIGHTrestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)EPSS 0.2%CVE-2026-8740MEDIUMSanluan PublicCMS templateResult API TemplateResultDirective.java execute special elements used in a template engineEPSS 0.2%CVE-2024-39766HIGHImproper neutralization of special elements used in SQL command in some Intel(R) Neural Compressor software before version v3.0 may allow anEPSS 0.2%CVE-2026-41713HIGHPrompt Injection via Memory Poisoning in PromptChatMemoryAdvisorEPSS 0.2%CVE-2026-96392LOWAI CKEditor - Moderately critical - Code execution via Twig templates - SA-CONTRIB-2026-187EPSS 0.2%CVE-2026-85654HIGHCode injection in the CDK generator in Amazon awslabs.dynamodb-mcp-serverEPSS 0.2%CVE-2026-73505HIGHOh My Posh: Arbitrary command execution via template injection in the path segmentEPSS 0.2%CVE-2026-54654HIGH`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` fieldEPSS 0.2%CVE-2026-54621HIGH`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union descriptionEPSS 0.2%CVE-2026-63728HIGHGitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template FeatureEPSS 0.2%CVE-2025-40900MEDIUMAngular template injection in Reports in Guardian/CMC before 26.1.0EPSS 0.2%CVE-2026-55242HIGHERPNext: Server-Side Template Injection (SSTI) in Batch autonaming via Stock Settings.naming_series_prefixEPSS 0.2%CVE-2026-41318MEDIUMAnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable componentEPSS 0.2%CVE-2026-107259MEDIUMLinked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200EPSS 0.2%CVE-2026-107264MEDIUMInline Formatter Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-203EPSS 0.2%CVE-2025-23376LOWDell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in EPSS 0.2%CVE-2026-75036MEDIUMFleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessingEPSS 0.2%CVE-2026-40320MEDIUMGiskard has an Unsandboxed Jinja2 Template Rendering in ConformityCheckEPSS 0.1%CVE-2026-49382MEDIUMIn JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginEPSS 0.1%