Use of HTTP Request With Sensitive Query String

Every one of the 99 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Use of GET Request Method With sensitive Query StringsCVE-2025-3943Tridium · CVSS 4.1 · 11% likely

   Tridium

2. ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensit…CVE-2017-3185ACTi Corporation · 3.2% likely

   ACTi Corporation

3. Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonat…CVE-2018-14822Entes · 2.9% likely
4. CVE-2023-28375ProPump and Controls, Inc. · CVSS 7.5 · 1.5% likely

   ProPump and Controls, Inc.

5. An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…CVE-2018-5467Belden · 1.3% likely

   Belden

6. MLflow Authentication BypassCVE-2023-6014mlflow · CVSS 9.1 · 1.2% likely

   MLflow

7. A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords o…CVE-2023-37935Fortinet · CVSS 6.5 · 1.1% likely

   Fortinet

8. Novell Identity Manager User Application get request url contains the session token.CVE-2017-9280NetIQ · CVSS 4.3 · 1.1% likely

   NetIQ

9. In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If t…CVE-2017-8443Elastic · 1.1% likely

   Elastic

10. An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) if the attacker…CVE-2019-6531Kunbus · 1.0% likely

    KUNBUS

11. The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious loc…CVE-2019-18573Dell · CVSS 8.7 · 1.0% likely

    Dell

12. Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL comma…CVE-2021-36328Dell · CVSS 8.8 · 0.9% likely

    Dell

13. Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive dat…CVE-2021-21594Dell · CVSS 8.2 · 0.8% likely

    Dell

14. RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An aut…CVE-2020-5331Dell · CVSS 8.8 · 0.7% likely

    Dell

15. TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query stringsCVE-2025-0730TP-Link · CVSS 3.7 · 0.7% likely

    TP-Link

16. Ebyte NA111-M Use of GET Request Method With Sensitive Query StringsCVE-2026-76179Ebyte · CVSS 9.8 · 0.7% likely

    Ebyte

17. Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may…CVE-2022-24414Dell · CVSS 7.6 · 0.6% likely

    Dell

18. django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query stringsCVE-2026-16207django-tastypie · CVSS 3.7 · 0.6% likely
19. Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query StringCVE-2026-88897flextype · CVSS 5.9 · 0.6% likely
20. openssl_encrypt before 1.4.0 Token Leakage via Query ParametersCVE-2026-74880jahlives · CVSS 9.8 · 0.6% likely

    Jahlives

21. File Browser allows sensitive data to be transferred in URLCVE-2025-52901filebrowser · CVSS 4.5 · 0.5% likely

    Filebrowser

22. IBM PowerSC information disclosureCVE-2023-50328IBM · CVSS 3.7 · 0.5% likely

    IBM

23. Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could…CVE-2026-22644SICK AG · CVSS 5.3 · 0.5% likely

    SICK AG

24. Apache OpenMeetings: Login Credentials Passed via GET Query ParametersCVE-2026-34020Apache Software Foundation · CVSS 7.5 · 0.5% likely

    Apache

25. Multiple Vulnerabilities in IBM Engineering AI hub.CVE-2026-15322IBM · CVSS 7.5 · 0.5% likely

    IBM

26. Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKCVE-2026-50157auth0 · CVSS 6.5 · 0.5% likely

    Auth0

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.