Fallos del tipo CWE-201

411 resultados

Inserção de informações sensíveis em dados enviados

A aplicação inclui dados sensíveis (senhas, tokens, chaves, PII) em comunicações que não deveriam contê-los — logs, requisições HTTP, mensagens de erro, caches ou tráfego de rede. O risco é esses dados serem interceptados, armazenados ou expostos em canais menos protegidos.

Ejemplo

Um sistema registra credenciais de banco de dados completas em logs de debug que ficam acessíveis a analistas, ou uma API retorna o token de autenticação do usuário em resposta de erro exibida ao cliente. Outro caso comum: enviar senhas em parâmetros de URL (no histórico do navegador e logs de servidor).

Cómo mitigar

Identifique quais dados são sensíveis e nunca os inclua em logs, mensagens de erro, caches ou respostas da API. Use máscara (ex: exibir apenas últimos 4 dígitos) quando necessário exibir, e sanitize outputs antes de enviar ao cliente. Revise regularmente logs e históricos de requisição.

CVE-2026-39564MEDIUMWordPress Sunshine Photo Cart plugin < 3.6.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-74008MEDIUMWordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39542MEDIUMWordPress Doofinder for WooCommerce plugin <= 2.10.13 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39570MEDIUMWordPress 12 Step Meeting List plugin <= 3.19.9 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39473MEDIUMWordPress Simple History plugin <= 5.24.0 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-39586MEDIUMWordPress RepairBuddy plugin <= 4.1132 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2021-23019—The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included iEPSS 0.2%CVE-2026-49064HIGHWordPress GetPaid plugin <= 2.8.49 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-52692HIGHWordPress Affiliates Manager plugin <= 2.9.50 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-32538HIGHWordPress SMTP Mailer plugin <= 1.1.24 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-35447MEDIUMNamelessMC: Private or blocking profile pages can be bypassed with direct POST requests, and reply handling allows cross-profile writesEPSS 0.2%CVE-2026-13380CRITICALVSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP ResponsesEPSS 0.2%CVE-2026-25339MEDIUMWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-66684MEDIUMWordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2026-66683MEDIUMWordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerabilityEPSS 0.2%CVE-2020-27784—A vulnerability was found in the Linux kernel, where accessing a deallocated instance in printer_ioctl() printer_ioctl() tries to access of EPSS 0.2%CVE-2026-42539MEDIUMIRIS has an Excessive Data Exposure issueEPSS 0.2%CVE-2025-44017MEDIUM"Gunosy" App contains a vulnerability where sensitive information may be included in the application's outbound communication. If a user accEPSS 0.2%CVE-2025-55710MEDIUMWordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure VulnerabilityEPSS 0.2%CVE-2026-67355HIGHguzzlehttp/guzzle before 7.15.1 Host-only Cookie ScopeEPSS 0.2%