CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
Monthly
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Information disclosure in the Brushfire video content streaming platform (online.brushfire.com) exposes internal database path strings within HTTP responses to unauthenticated remote users, allowing enumeration of other users' data. The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where backend infrastructure details are insufficiently abstracted from client-facing responses. The vendor applied a server-side fix in February 2026; no active exploitation has been confirmed and no public proof-of-concept has been identified.
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, confirmed via Dell Security Advisory DSA-2026-309. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H) indicates that a standard local account with no elevated rights and no user interaction is sufficient to trigger high-confidentiality-impact disclosure - potentially exposing hardware identifiers, system configuration details, or other privileged data handled by the update utility. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated sensitive data exposure in the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (versions ≤ 1.16.20) allows remote unauthenticated attackers to retrieve sensitive information without credentials or user interaction. Classified under CWE-497 and reported by Patchstack (EUVD-2026-60815), the flaw permits unauthorized parties to access data that should be confined to privileged or internal control spheres - likely via improperly access-controlled REST API or AJAX endpoints common in WordPress plugin architecture. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, no-authentication CVSS vector means exploitation would be trivial if targeted.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Physical access to the TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) PCB exposes an unprotected UART debug interface, allowing a physically proximate attacker to intercept the device boot process and runtime debug output without any authentication. Disclosed data - including OS version strings, software versions, network configuration, filesystem paths, and implementation internals - provides a reconnaissance foundation that can materially assist subsequent compromise of the device or connected infrastructure. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacent-network attackers to fingerprint the device's web application and firmware stack without any credentials. All firmware versions through 20072026 are affected per CPE data, and the CWE-497 root cause indicates the device's web interface leaks system-identifying data to any party on the adjacent network. No public exploit code or CISA KEV active exploitation has been identified at time of analysis, but the no-authentication, adjacent-network vector makes this trivially reachable by anyone connected to or physically proximate to the hotspot.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.
Information disclosure in the Brushfire video content streaming platform (online.brushfire.com) exposes internal database path strings within HTTP responses to unauthenticated remote users, allowing enumeration of other users' data. The root cause is CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where backend infrastructure details are insufficiently abstracted from client-facing responses. The vendor applied a server-side fix in February 2026; no active exploitation has been confirmed and no public proof-of-concept has been identified.
Dell Command Update (DCU) versions prior to 5.7.1 expose sensitive system information to low-privileged local users, confirmed via Dell Security Advisory DSA-2026-309. The CVSS vector (AV:L/AC:L/PR:L/UI:N/C:H) indicates that a standard local account with no elevated rights and no user interaction is sufficient to trigger high-confidentiality-impact disclosure - potentially exposing hardware identifiers, system configuration details, or other privileged data handled by the update utility. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated sensitive data exposure in the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (versions ≤ 1.16.20) allows remote unauthenticated attackers to retrieve sensitive information without credentials or user interaction. Classified under CWE-497 and reported by Patchstack (EUVD-2026-60815), the flaw permits unauthorized parties to access data that should be confined to privileged or internal control spheres - likely via improperly access-controlled REST API or AJAX endpoints common in WordPress plugin architecture. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, no-authentication CVSS vector means exploitation would be trivial if targeted.
Sensitive data exposure in the Duitku Payment Gateway WordPress plugin (versions up to and including 2.11.14) allows unauthenticated remote attackers to retrieve sensitive information without any credentials or user interaction. The vulnerability, classified under CWE-497, stems from the plugin failing to restrict access to system or operational data that should be shielded from public consumers. Reported by Patchstack, this flaw carries a CVSS 7.5 High rating driven entirely by confidentiality impact, with no public exploit or CISA KEV listing identified at time of analysis.
Sensitive data exposure in WooCommerce Appointments plugin (≤ 5.3.8) allows unauthenticated remote attackers to access confidential booking or customer information without any credentials or user interaction. Reported by Patchstack, this High-severity flaw (CVSS 7.5) requires no authentication, no special configuration, and no user interaction, making it trivially automatable by scanning tools. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack surface warrants prompt remediation.
Sensitive subscriber data exposure in the Payment Forms for Paystack WordPress plugin (versions ≤ 4.0.5) allows authenticated users holding a subscriber-level WordPress account to retrieve confidential payment-related information beyond their authorization scope. Rooted in CWE-497, the flaw is network-exploitable with low attack complexity and requires no user interaction beyond possession of a valid low-privilege session. No public exploit identified at time of analysis; the vulnerability was disclosed by Patchstack and is tracked under ENISA EUVD-2026-57869.
Physical access to the TBEA TLogger V2.1.0.0B0.0.0.0 (Communication Box 3rd Generation) PCB exposes an unprotected UART debug interface, allowing a physically proximate attacker to intercept the device boot process and runtime debug output without any authentication. Disclosed data - including OS version strings, software versions, network configuration, filesystem paths, and implementation internals - provides a reconnaissance foundation that can materially assist subsequent compromise of the device or connected infrastructure. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Sensitive system information exposure in the Zyxel WAH7601 portable 4G LTE mobile hotspot allows unauthenticated adjacent-network attackers to fingerprint the device's web application and firmware stack without any credentials. All firmware versions through 20072026 are affected per CPE data, and the CWE-497 root cause indicates the device's web interface leaks system-identifying data to any party on the adjacent network. No public exploit code or CISA KEV active exploitation has been identified at time of analysis, but the no-authentication, adjacent-network vector makes this trivially reachable by anyone connected to or physically proximate to the hotspot.
Kirby CMS's REST API error handler exposes full server filesystem paths to unauthenticated remote users via unsanitized PHP exception messages. Affected are all Kirby installations on versions prior to 4.9.5 (4.x branch) and 5.0.0 through 5.5.1 (5.x branch) where the REST API has not been explicitly disabled. An attacker triggering a PHP-level error receives the raw exception message - including absolute paths such as '/var/www/kirby-site/content/' - enabling server directory enumeration that lowers the bar for chained attacks. No public exploit or CISA KEV listing has been identified at time of analysis.