Falhas do tipo CWE-200

4.951 resultados

Exposição de informações sensíveis

A aplicação vaza dados sensíveis (senhas, tokens, PII, chaves de API) para usuários ou sistemas que não deveriam ter acesso. Ocorre quando controles de acesso falham, logs registram dados confidenciais, ou a informação fica visível em resposta HTTP, cache do navegador ou memória — criando oportunidade para roubo de credenciais e elevação de privilégio.

Exemplo

Um endpoint REST retorna o JSON de um usuário incluindo o hash de senha ou token de sessão sem autenticação adequada; ou um erro 500 exibe caminho completo de arquivos e variáveis de ambiente; ou um relatório PDF público contém CPF/CNPJ de clientes.

Como mitigar

Implemente controle de acesso rigoroso (verificar permissões antes de expor dados), remova dados sensíveis de respostas HTTP e logs (nunca logar senha ou token completo), use variáveis de ambiente para credenciais, habilite HTTPS e configure cache-control private, e realize teste de exposição de dados em todas as camadas (banco, API, frontend).

CVE-2026-78555CRITICALRansomLook API Key Disclosure Through /admin/apikeys HTML SourceEPSS 0.4%CVE-2026-30244HIGHPlane: Unauthenticated Workspace Member Information DisclosureEPSS 0.4%CVE-2024-39182HIGHAn information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via anEPSS 0.4%CVE-2022-48348CRITICALThe MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiaEPSS 0.4%CVE-2026-12408MEDIUMSlim SEO <= 4.9.8 - Authenticated (Contributor+) Insufficient Authorization to Private Content Disclosure via 'object.ID' ParameterEPSS 0.4%CVE-2024-11280MEDIUMPPWP – Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information ExposureEPSS 0.4%CVE-2025-11710CRITICALCross-process information leaked due to malicious IPC messagesEPSS 0.4%CVE-2026-7636MEDIUMSlider by Soliloquy <= 2.8.1 - Authenticated (Subscriber+) Information Disclosure via REST API EndpointEPSS 0.4%CVE-2022-48347—The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiEPSS 0.4%CVE-2022-32870LOWA logic issue was addressed with improved state management. This issue is fixed in iOS 16, macOS Ventura 13, watchOS 9. A user with physicalEPSS 0.4%CVE-2024-35691MEDIUMWordPress Widget Options - Extended plugin <= 5.1.0 - Multiple Data Exposure VulnerabilityEPSS 0.4%CVE-2025-32789LOWEspoCRM Allows Potential Disclosure of Sensitive Information in the User Sorting FunctionEPSS 0.4%CVE-2026-27457MEDIUMWeblate: Missing access control for the AddonViewSet API exposes all addon configurationsEPSS 0.4%CVE-2026-67436HIGHLinuxfabrik monitoring-plugins: SSRF and auth-token disclosure via unvalidated @odata.id link in redfish-* pluginsEPSS 0.4%CVE-2025-32698LOWLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsEPSS 0.4%CVE-2026-45080MEDIUMKlaw: Improper Access Control Allows Disclosure of Password HashEPSS 0.4%CVE-2024-13086MEDIUMQTS, QuTS heroEPSS 0.4%CVE-2026-65760CRITICALJoomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1EPSS 0.4%CVE-2026-57485HIGHStirling-PDF: Internal Service Account API Key Disclosure via Pipeline EndpointEPSS 0.4%CVE-2025-4798MEDIUMWP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File ReadEPSS 0.4%