Weaknesses of type CWE-200

4,927 results

Exposição de Informação Sensível

A aplicação expõe dados sensíveis (senhas, tokens, PII, chaves de API) a usuários ou processos que não deveriam ter acesso. Pode acontecer por falta de controle de acesso, logs inadequados, cache inseguro ou erro na filtragem de respostas. O risco é direto: um atacante rouba credenciais, identidades ou segredos da aplicação.

Example

Um endpoint retorna a lista completa de usuários com hashes de senha em resposta JSON, ou um arquivo de backup fica exposto publicamente no servidor web contendo variáveis de ambiente com conexão ao banco de dados.

How to mitigate

Implemente controle de acesso (RBAC/ABAC), nunca exponha dados sensíveis em logs ou respostas de erro, use criptografia em trânsito e em repouso, aplique princípio do menor privilégio, e realize auditorias regulares de quais dados cada endpoint retorna.

CVE-2022-30737MEDIUMImplicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID.EPSS 0.5%CVE-2024-32467MEDIUMMeteraphsere vulnerable to unauthorized viewing by workspace membersEPSS 0.5%CVE-2026-6492MEDIUMarnobt78 Hotel Booking Management System Health Check Endpoint detailed information disclosureEPSS 0.5%CVE-2026-86179MEDIUMcode-projects Daily Expense Manager Database Backup exp_ak.sql information disclosureEPSS 0.5%CVE-2026-86519MEDIUMcode-projects Student Crud Operation Backup File card_activation.sql information disclosureEPSS 0.5%CVE-2026-48855LOWSFTP READLINK Leaks Absolute Backend Filesystem Path When Root Is ConfiguredEPSS 0.5%CVE-2026-28213CRITICALEverShop Vulnerable to Arbitrary Customer Account Takeover via Exposure of Password Reset Token in API ResponseEPSS 0.5%CVE-2024-45624HIGHExposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table dEPSS 0.5%CVE-2026-82624MEDIUMcode-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosureEPSS 0.5%CVE-2026-16201MEDIUMzevorn rt-claw http_request net.c claw_net_post information disclosureEPSS 0.5%CVE-2022-30733MEDIUMSensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone nEPSS 0.5%CVE-2026-92927MEDIUMSourceCodester Drug Recommendation System drug_recommendor.sql information disclosureEPSS 0.5%CVE-2026-18974MEDIUMheshengtao super-agent-party execute_tool_manually Endpoint server.py get_file_content information disclosureEPSS 0.5%CVE-2022-30734MEDIUMSensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone EPSS 0.5%CVE-2026-86302MEDIUMcode-projects Hospital Information System SQL Database Backup File his.sql information disclosureEPSS 0.5%CVE-2026-86217MEDIUMcode-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql information disclosureEPSS 0.5%CVE-2025-8620MEDIUMGiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data ExposureEPSS 0.5%CVE-2026-82548MEDIUMLinux Foundation Magma InitialUEMessage information disclosureEPSS 0.5%CVE-2025-10321MEDIUMWavlink WL-WN578W2 live_online.shtml information disclosureEPSS 0.5%CVE-2024-53859MEDIUMgo-gh `auth.TokenForHost` violates GitHub host security boundary within a codespaceEPSS 0.5%