CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Monthly
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. Because MD5-crypt is computationally weak against modern GPU-based cracking tools, successful hash extraction typically escalates to full root-level device compromise. Reported by ICS-CERT under advisory ICSA-26-183-01; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under the JOYSOUND product ecosystem) allows unauthenticated remote attackers to retrieve confidential system details over the network without any privileges or user interaction. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the vulnerability was reported by JPCERT and documented in JVN advisory JVN#32505330. No public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network attack vector makes opportunistic probing accessible to low-skilled actors if the device is network-reachable.
Unauthenticated sensitive data exposure in dotstore's WooCommerce Product Attachment plugin (versions <= 2.3.3) allows remote, unauthenticated attackers to retrieve product attachment files that should be access-controlled. The vulnerability stems from insufficient authorization checks on attachment retrieval endpoints, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). No active exploitation has been confirmed by CISA KEV, and no public exploit code is identified at time of analysis, but the low attack complexity and zero-authentication requirement make opportunistic access trivial for any network-reachable attacker.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.
Information disclosure in Backdrop CMS 1.34.x before 1.34.5 and 1.35.x before 1.35.1 allows remote unauthenticated attackers to retrieve a previously generated compressed configuration export archive because the archive is not sufficiently protected during delivery. Exploitation is contingent on a configuration export having been previously requested by a user with the 'Synchronize, import, and export configuration' permission, which is the vendor-stated mitigating factor and the reason the assessed attack complexity is high. No public exploit code has been identified at the time of analysis, and the issue is fixed in Backdrop CMS 1.34.5 and 1.35.1.
Unauthenticated sensitive data exposure in the WordPress plugin Xserver Migrator affects all versions up to and including 1.6.6, allowing any remote attacker to read information the plugin should keep confidential, with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Because the vector carries PR:N and UI:N, no account, credentials, or user interaction are required, so an unexposed default installation running the vulnerable version is reachable directly over the network; the flaw carries high confidentiality impact with no integrity or availability effect, matching CWE-497. No public exploit code has been identified at time of analysis and the plugin has not been added to CISA KEV, so this is currently a patch-urgency rather than an active-incident issue; the practical exposure is limited because the plugin is a niche migration utility rather than a widely deployed component.
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. Because MD5-crypt is computationally weak against modern GPU-based cracking tools, successful hash extraction typically escalates to full root-level device compromise. Reported by ICS-CERT under advisory ICSA-26-183-01; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated network information disclosure in the Windows Services for NFS ONCRPC XDR Driver allows a remote attacker to obtain sensitive system information without any credentials or user interaction. The vulnerability, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), affects a broad range of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature releases. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the CVSS AV:N/AC:L/PR:N/UI:N profile indicates straightforward network exploitability wherever the NFS feature is enabled.
Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under the JOYSOUND product ecosystem) allows unauthenticated remote attackers to retrieve confidential system details over the network without any privileges or user interaction. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the vulnerability was reported by JPCERT and documented in JVN advisory JVN#32505330. No public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network attack vector makes opportunistic probing accessible to low-skilled actors if the device is network-reachable.
Unauthenticated sensitive data exposure in dotstore's WooCommerce Product Attachment plugin (versions <= 2.3.3) allows remote, unauthenticated attackers to retrieve product attachment files that should be access-controlled. The vulnerability stems from insufficient authorization checks on attachment retrieval endpoints, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). No active exploitation has been confirmed by CISA KEV, and no public exploit code is identified at time of analysis, but the low attack complexity and zero-authentication requirement make opportunistic access trivial for any network-reachable attacker.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Sensitive information disclosure in the Byteflows Travel & Hotel Booking plugin for WordPress allows unauthenticated remote attackers to read sensitive system data. The vulnerability affects plugin versions up to 1.0.0 and exposes information that could aid further attacks. No public exploit or active exploitation has been reported at time of analysis.