CWE-1230
Exposure of Sensitive Information Through Metadata
Description
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
Hierarchy (View 1000)
CVEs mapped to this weakness (26)
page 2 of 2| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-10324 | Med | 0.21 | 4.3 | 0.00 | Jan 24, 2025 | The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with… | ||
| CVE-2024-8910 | Med | 0.21 | 4.3 | 0.00 | Sep 25, 2024 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers,… | ||
| CVE-2025-8713 | Low | 0.20 | 3.1 | 0.00 | Aug 14, 2025 | PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data… | ||
| CVE-2026-14351 | Med | 0.00 | 4.3 | 0.00 | Jul 29, 2026 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly… | ||
| CVE-2025-48941 | Med | 0.00 | 5.3 | 0.00 | Jun 2, 2025 | MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title.… | ||
| CVE-2025-26527 | Med | 0.00 | 5.3 | 0.00 | Feb 24, 2025 | Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block. |
- risk 0.21cvss 4.3epss 0.00
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with…
- risk 0.21cvss 4.3epss 0.00
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers,…
- risk 0.20cvss 3.1epss 0.00
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data…
- risk 0.00cvss 4.3epss 0.00
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthenticated user to view the title of a confidential issue through a publicly…
- risk 0.00cvss 5.3epss 0.00
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title.…
- risk 0.00cvss 5.3epss 0.00
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.