CVE-2025-22828

CVE-2025-22828 📜 Description Apache CloudStack 4.16.0 and later versions have a broken access control issue that allows users with knowledge of resource UUIDs to read or add comments annotations on resources they are not authorized to access. UUIDs can be exposed in various parts of the...

CVE-2024-9014

This post is a research article published by EQSTLab. CVE-2024-9014 ★ CVE-2024-9014 Sensitive Information Exposure PoC ★ Description CVE-2024-9014 : pgAdmin4 Sensitive Information Exposure description: pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication...

TCExam <= 14.8.1 - Sensitive Information Exposure

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. id: CVE-2021-20114 info: name: TCExam = 14.8.1 - Sensitive Information Exposure author: push4d severity:...

Lokomedia CMS - Local File Inclusion

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. id: CVE-2010-2018 info: name: Lokomedia CMS - Local File Inclusion author: r3Y3r53 severit...

Jira - Local File Inclusion

Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion. id: CVE-2019-8442 info: name: Jira - Local File Inclusion author:...

LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure

The LiteSpeed Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.1 through the debug.log file that is publicly exposed. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

LearnPress < 4.2.7.4 - Course Material - Information Disclosure

LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. id: CVE-2024-11868 info: name: LearnPress 4.2.7.4 -...

djangohunter

Djangohunter Tool designed to help identify incorrectly configured Django applications that are exposing sensitive information. https://www.reddit.com/r/django/comments/87qcf4/28165thousanddjangorunningserversareexposed/ https://twitter.com/6ix7ine/status/978598496658960384?lang=en Usage...

CVE-2023-47529

CVE-2023-47529 Cloud Templates & Patterns collection = 1.2.2 - Sensitive Information Exposure via Log File root@kitploit: Description: The Cloud Templates & Patterns collection plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.2 via a l...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2026-16302

The Spectra Legacy – Gutenberg Blocks plugin for WordPress (versions up to and including 2.20.0 ) is vulnerable to Sensitive Information Exposure . The root cause is a missing capability check in the editor_assets function, which exposes the uag_insta_linked_accounts option via the uagb_blocks_in...

EUVD-2026-85856

The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editorassets function, which exposes the uaginstalinkedaccounts option through the uagbblocksinfo object without a capability check. This...

CVE-2024-1209

CVE-2024-1209 Sensitive Information Exposure via assignments in LearnDash. Unauthenticated visitors can browse and download uploaded assignments. Vulnerability: CVE-2024-1209 Sensitive Information Exposure via assignments CVSS: 5.3 Medium Software: LearnDash sfwd-lms Affected versions: = 4.10.1...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure vulnerability

Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by se1en in WordPress Plugin Spectra versions = 2.20.0...

CVE-2023-5359

CVE-2023-5359 - W3 Total Cache Cleartext Storage Vulnerability Description CVE-2023-5359 is a cleartext storage vulnerability affecting the WordPress plugin W3 Total Cache in versions ≤ 2.7.5. This vulnerability allows remote attackers to access sensitive credentials stored in unencrypted PHP fil...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

CVE-2019-1653

CVE-2019-1653 A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to retrieve sensitive information. Script python sederhana ini merupakan automation exploit pada CVE-2019-1653...

CVE-2026-85709 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documentroutes.py, graphroutes.py, queryroutes.py, ollamaapi.py, and lightragserver.py. The detail=stre, detail=strexc, and equivalent...

CVE-2026-85709 LightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in documentroutes.py, graphroutes.py, queryroutes.py, ollamaapi.py, and lightragserver.py. The detail=stre, detail=strexc, and equivalent...