CVE & Exploit Intelligence Database

CVE-2025-24567 6.5 MEDIUM EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data. This issue affects WP Mailster: from n/a through 1.8.16.0.

CWE-201 Feb 14, 2025

CVE-2025-24639 6.5 MEDIUM EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in GREYS Korea for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects Korea for WooCommerce: from n/a through 1.1.11.

CWE-201 Feb 03, 2025

CVE-2025-24597 6.5 MEDIUM EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in UkrSolution Barcode Generator for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects Barcode Generator for WooCommerce: from n/a through 2.0.2.

CWE-201 Jan 31, 2025

CVE-2025-24858 EPSS 0.00

Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the system user. The hash algorithm used by Develocity was chosen according to best practices for password storage and provides some protection against brute-force attempts. The applicable severity of this vulnerability depends on whether a Develocity server is accessible by external or unauthorized users, and the complexity of the System User password.

CWE-201 Jan 26, 2025

CVE-2023-38013 5.3 MEDIUM EPSS 0.00

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information in HTTP responses that could aid in further attacks against the system.

CWE-201 Jan 25, 2025

CVE-2025-24582 5.3 MEDIUM NUCLEI EPSS 0.05

Insertion of Sensitive Information Into Sent Data vulnerability in Code for Recovery 12 Step Meeting List allows Retrieve Embedded Sensitive Data. This issue affects 12 Step Meeting List: from n/a through 3.16.5.

CWE-201 Jan 24, 2025

CVE-2025-23781 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in NotFound WM Options Import Export allows Retrieve Embedded Sensitive Data. This issue affects WM Options Import Export: from n/a through 1.0.1.

CWE-201 Jan 22, 2025

CVE-2025-23774 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in NotFound WPDB to Sql allows Retrieve Embedded Sensitive Data. This issue affects WPDB to Sql: from n/a through 1.2.

CWE-201 Jan 22, 2025

CVE-2024-45653 4.3 MEDIUM EPSS 0.00

IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system.

CWE-201 Jan 19, 2025

CVE-2024-50633 NONE 1 PoC Analysis EPSS 0.09

A Broken Object Level Authorization (BOLA) vulnerability in Indico through 3.3.5 allows attackers to read information by sending a crafted POST request to the component /api/principals. NOTE: this is disputed by the Supplier because the product intentionally lets all users retrieve certain information about other user accounts (this functionality is, in the current design, not restricted to any privileged roles such as event organizer).

CWE-201 Jan 16, 2025

CVE-2024-46665 3.7 LOW EPSS 0.00

An insertion of sensitive information into sent data vulnerability [CWE-201] in FortiOS 7.6.0, 7.4.0 through 7.4.4 may allow an attacker in a man-in-the-middle position to retrieve the RADIUS accounting server shared secret via intercepting accounting-requests.

CWE-201 Jan 14, 2025

CVE-2024-13276 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal File Entity (fieldable files) allows Forceful Browsing.This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.39.

CWE-201 Jan 09, 2025

CVE-2024-13269 5.3 MEDIUM EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Advanced Varnish allows Forceful Browsing.This issue affects Advanced Varnish: from 0.0.0 before 4.0.11.

CWE-201 Jan 09, 2025

CVE-2024-13259 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.

CWE-201 Jan 09, 2025

CVE-2024-13254 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.

CWE-201 Jan 09, 2025

CVE-2025-22303 5.3 MEDIUM EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through 1.8.17.0.

CWE-201 Jan 07, 2025

CVE-2024-56300 7.5 HIGH EPSS 0.01

Insertion of Sensitive Information Into Sent Data vulnerability in WPSpins Post/Page Copying Tool allows Retrieve Embedded Sensitive Data.This issue affects Post/Page Copying Tool: from n/a through 2.0.0.

CWE-201 Jan 07, 2025

CVE-2024-8429 4.3 MEDIUM EPSS 0.00

Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials.This issue affects WiFiBurada: before 1.0.5.

CWE-201 Dec 17, 2024

CVE-2024-54309 6.5 MEDIUM EPSS 0.01

Insertion of Sensitive Information Into Sent Data vulnerability in wpdebuglog PostBox allows Retrieve Embedded Sensitive Data.This issue affects PostBox: from n/a through 1.0.4.

CWE-201 Dec 13, 2024

CVE-2024-53804 7.5 HIGH EPSS 0.00

Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster allows Retrieve Embedded Sensitive Data.This issue affects WP Mailster: from n/a through 1.8.16.0.

CWE-201 Dec 06, 2024