CVE Database

CVE-2025-9985 Medium · 5.3 Public exploit CWE-532 Sep 26, 2025

Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File

The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.

CVE-2025-34188 High · 7.8 CWE-532 Sep 19, 2025

Vasion Print (formerly PrinterLogic) Local Log Disclosure of Cleartext Sessions

Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) contain a vulnerability in the local logging mechanism. Authentication session tokens, including PHPSESSID, XSRF-TOKEN, and laravel_session, are stored in cleartext within world-readable log files. Any local user with access to the machine can extract these session tokens and use them to authenticate remotely to the SaaS environment, bypassing normal login credentials, potentially leading to unauthorized system access and exposure of sensitive information. This vulnerability has been identified by the vendor as: V-2022-008 — Secrets Leaked in Logs.

CVE-2025-43354 Medium · 5.5 CWE-532 Sep 15, 2025

A logging issue was addressed with improved data redaction. This issue is fixed in tvOS 26,...

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data.

CVE-2025-43303 Medium · 5.5 CWE-532 Sep 15, 2025

Insertion of Sensitive Information into Log File in Apple Ipados

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data.

CVE-2025-23261 Medium · 5.5 CWE-532 Sep 4, 2025

NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are...

NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing information to unauthorized users.

CVE-2025-41690 High · 7.4 CWE-532 Sep 2, 2025

Endress+Hauser: Proline 10 Maintenance credentials may be exposed under certain conditions

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.

CVE-2025-3456 Low · 3.8 CWE-532 Aug 25, 2025

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-

On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-config could then be used to obtain protocol specific passwords in cases where symmetric passwords are required between devices with neighbor protocol relationships.

CVE-2025-24984 Medium · 4.6 KEV High · 50 CWE-532 Mar 11, 2025

Microsoft Windows NTFS Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

CVE-2023-21492 Medium · 4.4 KEV High · 51 CWE-532 May 4, 2023

Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.