CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

Parent: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

90 vulnerabilities with CWE-538
CVE-2025-8452 MEDIUM
Brother DCP-L8410CDW and MFC-L Series - Sensitive Information Exposure via eSCL/uscan Protocol
CVSS 4.3
CVE-2025-46820 HIGH
phpgt/Dom < 4.1.8 - Exposure of Sensitive Information via GitHub Token in Workflow Artifact
CVSS 7.1
CVE-2025-20665 MEDIUM
Android - Local Information Disclosure via Missing SELinux Policy in devinfo
CVSS 5.5
CVE-2025-31421 MEDIUM
Oblak Studio Srbtranslatin <3.2.0 - Info Disclosure
CVSS 5.8
CVE-2025-31558 MEDIUM
Greg TailPress <0.4.4 - Info Disclosure
CVSS 5.8
CVE-2025-31550 MEDIUM
thom4 WP-LESS <= 1.9.6 - Sensitive Data Exposure via Externally-Accessible File
CVSS 5.8
CVE-2025-25586 MEDIUM
yimioa < 2024-07-04 - Information Disclosure via /resources/application.yml
CVSS 4.2
CVE-2025-27017 MEDIUM
Apache NiFi <2.3.0 - Info Disclosure
CVSS 6.5
CVE-2025-27150 MEDIUM
Tuleap <16.4.99.1740492866, <16.3-11 - Info Disclosure
CVSS 5.3
CVE-2025-22633 MEDIUM
Give - Divi Donation Modules <2.0.0 - Info Disclosure
CVSS 5.8
CVE-2025-24689 MEDIUM
Import and export users and customers <= 1.27.12 - Sensitive Data Exposure via Externally-Accessible File
CVSS 5.9
CVE-2025-22773 MEDIUM
WPChill Htaccess File Editor <1.0.19 - Info Disclosure
CVSS 5.3
CVE-2025-0194 MEDIUM
GitLab CE/EE <17.5.5-17.7.1 - Info Disclosure
CVSS 6.5
CVE-2025-22306 MEDIUM
Link Whisper Free <0.7.7 - Info Disclosure
CVSS 5.3
CVE-2024-51977 MEDIUM
Multiple Brother devices authentication bypass via default administrator password generation
CVSS 5.3
CVE-2024-6880 MEDIUM
MegaBIP < 5.15 - Sensitive Information Exposure via Registered.php
CVE-2024-47580 MEDIUM
SAP NetWeaver AS for JAVA (Adobe Document Services) - Information Disclosure
CVSS 6.8
CVE-2024-47579 MEDIUM
SAP NetWeaver AS for JAVA (Adobe Document Services) - Authenticated Arbitrary File Read via PDF Font Upload/Download
CVSS 6.8
CVE-2024-31954 HIGH
Samsung Portable SSD for T5 <1.6.10 - Privilege Escalation
CVSS 7.3
CVE-2024-22045 HIGH
SINEMA Remote Connect Client < V3.1 SP1 - Info Disclosure
CVSS 7.6
CVE-2024-21501 MEDIUM
sanitize-html < 2.12.1 - Information Exposure via Style Attribute
CVSS 5.3
CVE-2024-22433 HIGH
Dell Data Protection Search 19.2.0+ - Unauthenticated RCE
CVSS 8.8
CVE-2024-0191 MEDIUM
RRJ Nueva Ecija Engineer Online Portal 1.0 - Info Disclosure
CVSS 5.3
CVE-2023-54346 HIGH
WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download
CVSS 7.5
CVE-2023-7062 HIGH
Advanced File Manager Shortcodes <2.4 - Path Traversal
CVSS 8.8
Details
Vulnerabilities 90
Links
MITRE CWE Entry Search this CWE With Exploits