CWE-1266
Improper Scrubbing of Sensitive Data from Decommissioned Device
The product does not properly provide a capability for the product administrator to remove sensitive data at the time the product is decommissioned. A scrubbing capability could be missing, insufficient, or incorrect.
Impactr finds and proves whether CWE-1266 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.