Weaknesses of type CWE-201

411 results

Exposição de informações sensíveis em dados transmitidos

A aplicação envia informações sensíveis (senhas, tokens, dados pessoais, chaves) em comunicações que não deveriam conter essas informações. O desenvolvedor inclui acidentalmente ou por falha de lógica dados confidenciais em respostas, logs, cookies ou requisições que podem ser interceptadas ou expostas.

Example

Um sistema de e-commerce retorna a senha do usuário em uma resposta JSON após login, ou inclui o token de autenticação em um parâmetro GET visível na URL, permitindo que seja capturada em logs de servidor ou histórico do navegador.

How to mitigate

Revise todo dado enviado em respostas HTTP, cookies e headers para eliminar informações sensíveis; use variáveis de ambiente para credenciais, nunca as codifique; aplique sanitização antes de escrever em logs; utilize HTTPS obrigatoriamente e tokens seguros com ciclo de vida limitado.

CVE-2026-39564MEDIUMWordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-74008MEDIUMWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39542MEDIUMWordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39570MEDIUMWordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39473MEDIUMWordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39586MEDIUMWordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2021-23019—The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included iEPSS 0.2%CVE-2026-49064HIGHWordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-52692HIGHWordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-32538HIGHWordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-35447MEDIUMNamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writesEPSS 0.2%CVE-2026-13380CRITICALVSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP ResponsesEPSS 0.2%CVE-2026-25339MEDIUMWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-66684MEDIUMWordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-66683MEDIUMWordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2020-27784—A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of EPSS 0.2%CVE-2026-42539MEDIUMIRIS has an Excessive Data Exposure issueEPSS 0.2%CVE-2025-44017MEDIUM"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accEPSS 0.2%CVE-2025-55710MEDIUMWordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure VulnerabilityEPSS 0.2%CVE-2026-67355HIGHguzzlehttp/guzzle before 7.15.1 Host-only Cookie ScopeEPSS 0.2%