CWE-201
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Impactr finds and proves whether CWE-201 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.