Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-200 (信息暴露) — Vulnerability Class 2752

2752 vulnerabilities classified as CWE-200 (信息暴露). AI Chinese analysis included.

CWE-200 represents a critical information disclosure weakness where software inadvertently reveals sensitive data to unauthorized entities. This vulnerability is typically exploited by attackers who leverage insufficient access controls, insecure direct object references, or verbose error messages to harvest credentials, personal identifiable information, or internal system details. By analyzing network traffic or manipulating application inputs, adversaries can extract this exposed data to facilitate further attacks, such as identity theft or privilege escalation. To mitigate this risk, developers must implement strict access control mechanisms, ensuring that data retrieval is validated against user permissions. Additionally, employing robust encryption for data at rest and in transit, along with sanitizing error outputs to prevent information leakage, significantly reduces the attack surface. Regular security audits and adherence to the principle of least privilege further ensure that sensitive information remains protected from unauthorized exposure.

MITRE CWE Description
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. There are many different kinds of mistakes that introduce information exposures. The severity of the error can range widely, depending on the context in which the product operates, the type of sensitive information that is revealed, and the benefits it may provide to an attacker. Some kinds of sensitive information include: private, personal information, such as personal messages, financial data, health records, geographic location, or contact details system status and environment, such as the operating system and installed packages business secrets and intellectual property network status and configuration the product's own code or internal state metadata, e.g. logging of connections or message headers indirect information, such as a discrepancy between two internal operations that can be observed by an outsider Information might be sensitive to different parties, each of which may have their own expectations for whether the information should be protected. These parties include: the product's own users people or organizations whose information is created or used by the product, even if they are not direct product users the product's administrators, including the admins of the system(s) and/or networks on which the product operates the developer Information exposures can occur in different ways: the code explicitly inserts sensitive information into …
Common Consequences (1)
ConfidentialityRead Application Data
Mitigations (1)
Architecture and DesignCompartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separatio…
Examples (2)
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
my $username=param('username'); my $password=param('password'); if (IsValidUsername($username) == 1) { if (IsValidPassword($username, $password) == 1) { print "Login Successful"; } else { print "Login Failed - incorrect password"; } } else { print "Login Failed - unknown username"; }
Bad · Perl
"Login Failed - incorrect username or password"
Result
This code tries to open a database connection, and prints any exceptions that occur.
try { openDbConnection(); } //print exception message that includes exception message and configuration file location catch (Exception $e) { echo 'Caught exception: ', $e->getMessage(), '\n'; echo 'Check credentials in config file at: ', $Mysql_config_location, '\n'; }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2026-20141 Improper Access Control in Splunk Monitoring Console App — Splunk Enterprise 4.3 Medium2026-02-18
CVE-2026-20137 Risky Commands Safeguards Bypass through preloaded Data Models due to Path Traversal vulnerability in Splunk Enterprise — Splunk Enterprise 3.5 Low2026-02-18
CVE-2026-1582 WP All Export <= 1.4.14 - Unauthenticated Sensitive Information Exposure via PHP Type Juggling — WP All Export – Drag & Drop Export to Any Custom CSV, XML & Excel 3.7 Low2026-02-18
CVE-2025-12074 Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure — Context Blog 5.3 Medium2026-02-18
CVE-2025-13821 User profile update exposes password hash and MFA secrets — Mattermost 5.7 Medium2026-02-16
CVE-2025-13973 StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure — StickEasy Protected Contact Form 5.3 Medium2026-02-14
CVE-2026-26273 Known affected by Account Takeover via Password Reset Token Leakage — known 9.8AICriticalAI2026-02-13
CVE-2026-26069 Scraparr Readarr Integration exposes sensitive values as metric labels. — scraparr 5.9AIMediumAI2026-02-12
CVE-2026-26014 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key — dtls 5.9 Medium2026-02-11
CVE-2026-2295 WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more — WPZOOM Addons for Elementor – Starter Templates & Widgets 5.3 Medium2026-02-11
CVE-2026-21260 Microsoft Outlook Spoofing Vulnerability — Microsoft 365 Apps for Enterprise 7.5 High2026-02-10
CVE-2025-68686 Fortinet FortiOS 信息泄露漏洞 — FortiOS 5.3 Medium2026-02-10
CVE-2026-2268 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action — Ninja Forms – The Contact Form Builder That Grows With You 7.5 High2026-02-10
CVE-2026-24098 Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors — Apache Airflow 4.3AIMediumAI2026-02-09
CVE-2026-2148 Tenda AC21 Web Management DownloadFlash information disclosure — AC21 5.3 Medium2026-02-08
CVE-2026-2147 Tenda AC21 Web Management DownloadLog information disclosure — AC21 5.3 Medium2026-02-08
CVE-2026-2207 WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure — WeKan 5.3 Medium2026-02-08
CVE-2026-2205 WeKan Meteor Publication cards.js CardPubSubBleed information disclosure — WeKan 4.3 Medium2026-02-08
CVE-2026-1727 Information Disclosure via Bucket Squatting in Google Cloud Agentspace. — Gemini Enterprise (formerly Agentspace) 7.5AIHighAI2026-02-06
CVE-2026-25650 MCP Salesforce Connector has arbitrary attribute access which leads to disclosure of Salesforce auth token — MCP-Salesforce 5.3AIMediumAI2026-02-06
CVE-2026-2056 D-Link DIR-605L/DIR-619L DHCP Connection Status wan_connection_status.asp information disclosure — DIR-605L 5.3 Medium2026-02-06
CVE-2026-2055 D-Link DIR-605L/DIR-619L DHCP Client Information information disclosure — DIR-605L 5.3 Medium2026-02-06
CVE-2026-2054 D-Link DIR-605L/DIR-619L Wifi Setting information disclosure — DIR-605L 5.3 Medium2026-02-06
CVE-2026-24916 Huawei HarmonyOS 安全漏洞 — HarmonyOS 5.9 Medium2026-02-06
CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla — EasyDiscuss extension for Joomla 7.5AIHighAI2026-02-06
CVE-2026-21532 Azure Function Information Disclosure Vulnerability — Azure Functions 8.2 High2026-02-05
CVE-2026-25523 Magento's X-Original-Url header can expose admin url — magento-lts 5.3 Medium2026-02-04
CVE-2026-25475 OpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction — openclaw 6.5 Medium2026-02-04
CVE-2026-20730 BIG-IP Edge Client for Windows vulnerability — BIG-IP Edge Client 3.3 Low2026-02-04
CVE-2025-15508 Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure — Magic Import Document Extractor 5.3 Medium2026-02-04

Vulnerabilities classified as CWE-200 (信息暴露) represent 2752 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.