Weaknesses of type CWE-88

379 results

Divulgação de Informações

Ocorre quando um programa expõe dados sensíveis (credenciais, tokens, caminhos internos, versões de sistemas) a usuários ou processos não autorizados. O risco está na falta de controle sobre quem acessa o quê, permitindo que informações confidenciais sejam lidas ou inferidas por atacantes.

Example

Um servidor web retorna mensagens de erro detalhadas que revelam a estrutura do banco de dados, ou uma API expõe UUIDs internos de usuários em respostas públicas, ou logs de aplicação contêm senhas armazenadas de forma legível em arquivos acessíveis.

How to mitigate

Implemente controle de acesso baseado em papéis (RBAC), sanitize mensagens de erro para produção (sem detalhes técnicos), criptografe dados em repouso e em trânsito, revise permissões de arquivos e endpoints, e monitore o que é expostos em respostas HTTP e logs.

CVE-2025-35004HIGHMicrohard Bullet-LTE and IPn4Gii AT+MFIP Argument InjectionEPSS 1.1%CVE-2024-23731CRITICALThe OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function arguEPSS 1.1%CVE-2026-73240CRITICALApache Allura: Git command injectionEPSS 1.0%CVE-2025-3460HIGHON Semiconductor Quantenna set_tx_pow Argument InjectionEPSS 1.0%CVE-2026-72538HIGHPrefectHQ Prefect - Argument InjectionEPSS 1.0%CVE-2022-1399CRITICALRemote code execution in scheduled tasks componentEPSS 1.0%CVE-2022-47502—Apache OpenOffice: Macro URL arbitrary script executionEPSS 1.0%CVE-2026-44189HIGHAnsible-lightspeed: visual studio code ansible lightspeed extension: arbitrary code execution via malicious playbook filenameEPSS 1.0%CVE-2026-57572CRITICALCrawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_argsEPSS 0.9%CVE-2024-47516CRITICALPagure: argument injection in pagurerepo.log()EPSS 0.9%CVE-2024-35307CRITICALArgument Injection Leading to Remote Code Execution in Realtime Graph ExtensionEPSS 0.9%CVE-2026-25134CRITICALGroup-Office Argument Injection in MaintenanceController::actionZipLanguageEPSS 0.9%CVE-2020-7496—A CWE-88: Argument Injection or Modification vulnerability exists in EcoStruxure Operator Terminal Expert 3.1 Service Pack 1 and prior (formEPSS 0.9%CVE-2026-6951CRITICALVersions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912]EPSS 0.9%CVE-2026-27613CRITICALCGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam)EPSS 0.9%CVE-2026-123285MEDIUMIn JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionEPSS 0.9%CVE-2024-47553CRITICALA vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate uEPSS 0.8%CVE-2025-1712HIGHArbitrary file write with vcrtraceEPSS 0.8%CVE-2022-47926CRITICALAyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.phpEPSS 0.8%CVE-2026-0774HIGHWatchYourLAN Configuration Page Argument Injection Remote Code Execution VulnerabilityEPSS 0.8%