References https://www.zaproxy.org/docs/alerts/10045-1/ https://docs.stackhawk.com/vulnerabilities/10045/ https://coderanch.com/t/547261/application-servers/WEB-INF-web-xml-exposed https://www.acunetix.com/vulnerabilities/web/web-xml-configuration-file-disclosure/ https://www.zaproxy.org/docs/alerts/10045/ https://pentest-tools.com/vulnerabilities-exploits/web-inf-information-disclosure-vulnerability-http_5054 https://www.zaproxy.org/docs/alerts/10045-2/ https://www.acunetix.com/vulnerabilities/web/web-xml-configuration-file-disclosure/ https://coderanch.com/t/547261/application-servers/WEB-INF-web-xml-exposed https://pentest-tools.com/vulnerabilities-exploits/web-inf-information-disclosure-vulnerability-http_5054 https://www.invicti.com/web-application-vulnerabilities/custom-error-pages-are-not-configured-in-web-inf-web-xml
Related VulnerabilitiesPoCCVE-2026-26265: Discourse - Private User Field Disclosure via Directory Items IDORPoCCVE-2026-27454: Discourse <=2026.2.0 - Hidden Post Revision Disclosure via revert_to Authorization BypassPoCCVE-2026-81199: MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics DisclosurePoCCVE-2026-87820: CyberPanel 2.4.3-2.4.5 - AI Scanner Debug DisclosurePoCCVE-2017-8225: GoAhead Camera - Credential DisclosurePoCCVE-2026-55229: Gotenberg < 8.34.0 - Local File DisclosurePoCCVE-2025-53887: Directus < 11.9.0 - Version DisclosurePoCCVE-2026-42878: FacturaScripts - Unauthenticated phpinfo DisclosurePoCCVE-2026-0717: LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings DisclosurePoCCVE-2026-11801: WPAdverts <= 2.3.2 - Information DisclosurePoCCVE-2026-8236: Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata DisclosurePoCCVE-2026-57219: RabbitMQ Management - OAuth 2 Client Secret DisclosurePoCCVE-2026-8237: Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)