Description

This secure (https) page contains a form that is posting to an insecure (http) page. This could confuse users who may think their data is encrypted when in fact it's not.

Remediation

The form target should point to a secure (https) page.

References

OWASP - Transport Layer Protection Cheat Sheet

CWE-319: Cleartext Transmission of Sensitive Information

Related Vulnerabilities

WordPress Plugin Simple Gmail Login Stack Trace Information Disclosure (1.1.3)

PHP upload arbitrary file disclosure vulnerability

WordPress Plugin Better WordPress Minify Arbitrary File Disclosure (1.2.2)

Test CGI script leaking environment variables

InfluxDB Unauthorized Access Vulnerability

Severity

Low

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure Sensitive Data Not Over Ssl CWE-200