Social security numbers disclosed
Summary: PortSwigger Research notes that applications sometimes disclose sensitive personal information such as social security numbers in their responses. The text cautions that such a response may not represent a security vulnerability, since the number may belong to the logged-in user it is displayed to, and says any social security number found during an assessment should be verified and the application logic reviewed to determine whether its disclosure is necessary and appropriate.
What's compelling: A social security number appearing in an application response is not automatically a finding, so the distinction between a user seeing their own number and a genuine exposure rests on verification and a review of the application logic.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026