Credit card numbers disclosed
Summary: PortSwigger Research notes that applications sometimes disclose sensitive financial information such as credit card numbers in their responses. It cautions that a response containing a credit card number may not represent a security vulnerability, since the number may belong to the logged-in user to whom it is displayed, and advises verifying any identified number and reviewing application logic to determine whether the disclosure is necessary and appropriate.
Why it matters: A credit card number appearing in a response is not automatically a finding, so the real work is confirming whose number it is and whether the application needs to show it at all.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026