Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2752

2752 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2025-11997 Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure — Document Pro Elementor – Documentation & Knowledge Base 5.3 Medium2025-11-11
CVE-2025-12010 Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode — Authors List 6.5 Medium2025-11-11
CVE-2025-12098 Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script' — Academy LMS Pro 5.3 Medium2025-11-08
CVE-2025-20377 Cisco Unified Intelligence Center API Information Disclosure Vulnerability — Cisco Packaged Contact Center Enterprise 4.3 Medium2025-11-05
CVE-2025-12468 FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure — FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce 5.3 Medium2025-11-05
CVE-2025-12677 KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure — KiotViet Sync 5.3 Medium2025-11-05
CVE-2025-12139 File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure — File Manager for Google Drive – Integrate Google Drive 7.5 High2025-11-05
CVE-2025-11749 AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation — AI Engine – The Chatbot, AI Framework & MCP for WordPress 9.8 Critical2025-11-05
CVE-2025-62721 LinkAce: Authorization Bypass Allows Unauthorized Access to All Private Links, Lists, and Tags — LinkAce 4.3AIMediumAI2025-11-04
CVE-2025-62720 LinkAce: Data Exfiltration via Export Functions Allow Access to All Users' Private Links — LinkAce 4.3AIMediumAI2025-11-04
CVE-2025-11983 WP Discourse <= 2.5.9 - Authenticated (Author+) Information Exposure — WP Discourse 4.3 Medium2025-11-01
CVE-2025-11377 List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure — List category posts 4.3 Medium2025-11-01
CVE-2025-12521 Analytify Pro <= 7.0.3 - Unauthenticated Information Exposure — Analytify Pro 5.3 Medium2025-10-31
CVE-2025-34272 Nagios Log Server < 2024R2.0.3 Non-Empty Default Dashboard Fallback — Log Server 9.1AICriticalAI2025-10-30
CVE-2025-11998 HP Card Readers (B Models) – Potential Information Disclosure — Card Readers B Model 5.3AIMediumAI2025-10-30
CVE-2025-54548 On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) — DANZ Monitoring Fabric 4.3 Medium2025-10-29
CVE-2025-11203 LiteLLM Information health API_KEY Information Disclosure Vulnerability — LiteLLM 6.5AIMediumAI2025-10-29
CVE-2025-12148 Unauthorized access to fields protected by Field Masking (FM) for fields of type IP — Search Guard FLX 9.1AICriticalAI2025-10-29
CVE-2025-12147 Unauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an object — Search Guard FLX 9.1AICriticalAI2025-10-29
CVE-2023-7320 WooCommerce <= 7.8.2 - Sensitive Information Exposure — WooCommerce 5.3 Medium2025-10-29
CVE-2025-62524 PILOS Exposes PHP version — PILOS 5.3 Medium2025-10-27
CVE-2025-12363 Email Password Disclosure — BLU-IC2 6.5AIMediumAI2025-10-27
CVE-2025-12297 atjiu pybbs UserApiController.java information disclosure — pybbs 4.3 Medium2025-10-27
CVE-2025-12276 LearnHouse Image information disclosure — LearnHouse 4.3 Medium2025-10-27
CVE-2025-11760 eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure — eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams 5.3 Medium2025-10-25
CVE-2025-6980 Captive Portal can expose sensitive information — Arista Edge Threat Management - Arista Next Generation Firewall 7.5 High2025-10-23
CVE-2025-62400 Moodle: hidden group names visible to event creators 4.3 Medium2025-10-23
CVE-2025-62604 MeterSphere logic flaw allows retrieval of arbitrary user information — metersphere 7.5AIHighAI2025-10-22
CVE-2025-11151 Information Disclosure in Beyaz Computer's CityPLus — CityPLus 8.2 High2025-10-21
CVE-2025-6239 Information disclosure — ManageEngine Applications Manager 6.5 Medium2025-10-21

Vulnerabilities classified as CWE-200 (信息暴露) represent 2752 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.