VYPR

CWE-202

Exposure of Sensitive Information Through Data Queries

BaseDraftLikelihood: Medium

Description

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.

Hierarchy (View 1000)

Parents

Children

none

CVEs mapped to this weakness (43)

page 3 of 3
  • CVE-2025-64504MedNov 10, 2025
    Langfuse
    Langfuse
    risk 0.00cvss 5.0epss 0.00

    Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, in certain project membership APIs, the server trusted a user‑controlled orgId and used it in authorization checks. As a result, any…

  • CVE-2025-25205HigFeb 12, 2025
    Audiobookshelf
    Audiobookshelf
    risk 0.00cvss 8.2epss 0.05

    Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs…

  • CVE-2021-4159MedAug 24, 2022
    Linux
    Kernel
    risk 0.00cvss 4.4epss 0.00

    A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory…