Description

One or more pages contain HTML comments that look like SQL statements. These SQL statements may disclose sensitive information to an attacker. This alert may be a false positive.

Remediation

These comments should be investigated and, if necessary, removed from the pages.

References

OWASP - Information Disclosure

CWE-615: Inclusion of Sensitive Information in Source Code Comments

Related Vulnerabilities

WordPress Plugin W3 Total Cache Multiple Vulnerabilities (0.9.4.1)

WordPress Plugin ACF to REST API Information Disclosure (3.2.0)

Consul API publicly exposed

WordPress Plugin HTML5 MP3 Player with Playlist Free Information Disclosure (2.6)

phpMyAdmin Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-5739)

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Information Disclosure