CWE-598 · Information Disclosure
Use of HTTP Request With Sensitive Query String
99CVEs
SortMost likely exploited
99 CVEs with CWE-598 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-3943Use of GET Request Method With sensitive Query StringsTridium · Niagara Framework · CVSS 4.1 · 2025-05-22 | 4.1 | 11% | 2025-05-22 |
| CVE-2017-3185ACTi cameras including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests that contain sensit…ACTi Corporation · ACTi D, B, I, and E series cameras · 2017-12-15 | – | 3.2% | 2017-12-15 |
| CVE-2018-14822Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonat…Entes · EMG12 · 2018-10-02 | – | 2.9% | 2018-10-02 |
| CVE-2023-28375CVE-2023-28375ProPump and Controls, Inc. · Osprey Pump Controller · CVSS 7.5 · 2023-03-28 | 7.5 | 1.5% | 2023-03-28 |
| CVE-2018-5467An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform…Belden · Hirschmann Automation and Control GmbH Classic Platform Switches · 2018-03-06 | – | 1.3% | 2018-03-06 |
| CVE-2023-6014MLflow Authentication Bypassmlflow · mlflow/mlflow · CVSS 9.1 · 2023-11-16 | 9.1 | 1.2% | 2023-11-16 |
| CVE-2023-37935A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an attacker to view plaintext passwords o…Fortinet · FortiOS · CVSS 6.5 · 2023-10-10 | 6.5 | 1.1% | 2023-10-10 |
| CVE-2017-9280Novell Identity Manager User Application get request url contains the session token.NetIQ · Identity Manager Applications · CVSS 4.3 · 2018-03-02 | 4.3 | 1.1% | 2018-03-02 |
| CVE-2017-8443In Kibana X-Pack security versions prior to 5.4.3 if a Kibana user opens a crafted Kibana URL the result could be a redirect to an improperly initialized Kibana login screen. If t…Elastic · Kibana X-Pack Security · 2017-06-30 | – | 1.1% | 2017-06-30 |
| CVE-2019-6531An attacker could retrieve passwords from a HTTP GET request from the Kunbus PR100088 Modbus gateway versions prior to Release R02 (or Software Version 1.1.13166) if the attacker…Kunbus · PR100088 Modbus gateway · 2019-04-02 | – | 1.0% | 2019-04-02 |
| CVE-2019-18573The RSA Identity Governance and Lifecycle and RSA Via Lifecycle and Governance products prior to 7.1.1 P03 contain a Session Fixation vulnerability. An authenticated malicious loc…Dell · RSA Identity Governance & Lifecycle · CVSS 8.7 · 2019-12-18 | 8.7 | 1.0% | 2019-12-18 |
| CVE-2021-36328Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL comma…Dell · Dell EMC Streaming Data Platform · CVSS 8.8 · 2021-11-30 | 8.8 | 0.9% | 2021-11-30 |
| CVE-2021-21594Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive dat…Dell · PowerScale OneFS · CVSS 8.2 · 2021-08-16 | 8.2 | 0.8% | 2021-08-16 |
| CVE-2020-5331RSA Archer, versions prior to 6.7 P3 (6.7.0.3), contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An aut…Dell · RSA Archer · CVSS 8.8 · 2020-05-04 | 8.8 | 0.7% | 2020-05-04 |
| CVE-2025-0730TP-Link TL-SG108E HTTP GET Request usr_account_set.cgi get request method with sensitive query stringsTP-Link · TL-SG108E · CVSS 3.7 · 2025-01-27 | 3.7 | 0.7% | 2025-01-27 |
| CVE-2026-76179Ebyte NA111-M Use of GET Request Method With Sensitive Query StringsEbyte · Ebyte NA111-M Firmware · CVSS 9.8 · 2026-08-27 | 9.8 | 0.7% | 2026-08-27 |
| CVE-2022-24414Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may…Dell · CloudLink · CVSS 7.6 · 2022-05-26 | 7.6 | 0.6% | 2022-05-26 |
| CVE-2026-16207django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query stringsdjango-tastypie · CVSS 3.7 · 2026-07-19 | 3.7 | 0.6% | 2026-07-19 |
| CVE-2026-88897Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query Stringflextype · flextype · CVSS 5.9 · 2026-09-10 | 5.9 | 0.6% | 2026-09-10 |
| CVE-2026-74880openssl_encrypt before 1.4.0 Token Leakage via Query Parametersjahlives · openssl_encrypt · CVSS 9.8 · 2026-08-17 | 9.8 | 0.6% | 2026-08-17 |
| CVE-2025-52901File Browser allows sensitive data to be transferred in URLfilebrowser · filebrowser · CVSS 4.5 · 2025-06-30 | 4.5 | 0.5% | 2025-06-30 |
| CVE-2023-50328IBM PowerSC information disclosureIBM · PowerSC · CVSS 3.7 · 2024-02-02 | 3.7 | 0.5% | 2024-02-02 |
| CVE-2026-22644Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could…SICK AG · Incoming Goods Suite · CVSS 5.3 · 2026-01-15 | 5.3 | 0.5% | 2026-01-15 |
| CVE-2026-34020Apache OpenMeetings: Login Credentials Passed via GET Query ParametersApache Software Foundation · Apache OpenMeetings · CVSS 7.5 · 2026-04-09 | 7.5 | 0.5% | 2026-04-09 |
| CVE-2026-15322Multiple Vulnerabilities in IBM Engineering AI hub.IBM · Engineering AI Hub · CVSS 7.5 · 2026-07-17 | 7.5 | 0.5% | 2026-07-17 |
| CVE-2026-50157Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKauth0 · symfony · CVSS 6.5 · 2026-09-14 | 6.5 | 0.5% | 2026-09-14 |
| CVE-2023-32335IBM Maximo Application Suite information disclosureIBM · Maximo Application Suite · CVSS 3.7 · 2024-03-13 | 3.7 | 0.5% | 2024-03-13 |
| CVE-2026-63408Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parametergetgrav · grav-plugin-api · CVSS 7.5 · 2026-08-19 | 7.5 | 0.5% | 2026-08-19 |
| CVE-2026-25118immich-server: Insecure Transmission of Authentication Credentials via Password Parameter in HTTP Request Query String When Accessing Shared Albumsimmich-app · immich · CVSS 6.3 · 2026-04-03 | 6.3 | 0.5% | 2026-04-03 |
| CVE-2026-23846Tugtainer vulnerable to Password Exposure via URL Query ParameterQuenary · tugtainer · CVSS 8.1 · 2026-01-19 | 8.1 | 0.5% | 2026-01-19 |
| CVE-2025-26473Outback Power Mojave Inverter Use of GET Request Method With Sensitive Query StringsOutback Power · Mojave Inverter · CVSS 7.5 · 2025-02-13 | 7.5 | 0.5% | 2025-02-13 |
| CVE-2025-49188Sensitive Data in URLSICK AG · SICK Field Analytics · CVSS 5.3 · 2025-06-12 | 5.3 | 0.5% | 2025-06-12 |
| CVE-2024-23766An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the r…No vendor recorded · CVSS 7.5 · 2024-06-26 | 7.5 | 0.4% | 2024-06-26 |
| CVE-2022-34452PowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information disclosure vulnerability. An Authenticated admin user can able to exploit the iss…Dell · PowerPath Management Appliance · CVSS 2.7 · 2023-02-10 | 2.7 | 0.4% | 2023-02-10 |
| CVE-2024-38863CSRF token leaked in URL parametersCheckmk GmbH · Checkmk · CVSS 2 · 2024-10-14 | 2.0 | 0.4% | 2024-10-14 |
| CVE-2026-113669ApostropheCMS: Cross-domain session token in URL confers session takeoverapostrophecms · apostrophe · CVSS 5.3 · 2026-10-20 | 5.3 | 0.4% | 2026-10-20 |
| CVE-2025-2356BlackVue App API deviceDelete get request method with sensitive query stringsBlackVue · App · CVSS 3.7 · 2025-03-17 | 3.7 | 0.4% | 2025-03-17 |
| CVE-2026-66832Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query stringsQuanovate Tech Inc. (operating as Mira / Mira Care) · Mira Firmware · CVSS 6.5 · 2026-08-11 | 6.5 | 0.4% | 2026-08-11 |
| CVE-2025-58584Plain Text Transmission of Username and Password in the URLSICK AG · Baggage Analytics · CVSS 5.3 · 2025-10-06 | 5.3 | 0.4% | 2025-10-06 |
| CVE-2022-22551DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and h…Dell · AppSync · CVSS 8.3 · 2022-01-21 | 8.3 | 0.4% | 2022-01-21 |
| CVE-2025-32021Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintextWeblateOrg · weblate · CVSS 2.2 · 2025-04-15 | 2.2 | 0.4% | 2025-04-15 |
| CVE-2024-12012A CWE-598 “Use of GET Request Method with Sensitive Query Strings” was discovered affecting the 130.8005 TCP/IP Gateway running firmware version 12h. Both the SHA-1 hash of the pa…Zettler · 130.8005 · CVSS 5.7 · 2025-02-13 | 5.7 | 0.4% | 2025-02-13 |
| CVE-2025-22387An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL p…Optimizely · Configured Commerce · CVSS 7.5 · 2025-01-04 | 7.5 | 0.4% | 2025-01-04 |
| CVE-2025-13219Multiple vulnerabilities in IBM Aspera OrchestratorIBM · Aspera Orchestrator · CVSS 5.9 · 2026-03-10 | 5.9 | 0.4% | 2026-03-10 |
| CVE-2024-32931exacqVison - Token Disclosed in URLJohnson Controls · exacqVision · CVSS 5.7 · 2024-08-01 | 5.7 | 0.4% | 2024-08-01 |
| CVE-2021-41719Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that…No vendor recorded · CVSS 7.5 · 2025-03-04 | 7.5 | 0.4% | 2025-03-04 |
| CVE-2025-3637Moodle: csrf token exposure via url in moodle mod_data moduleMoodle · Moodle · CVSS 3.1 · 2025-04-25 | 3.1 | 0.4% | 2025-04-25 |
| CVE-2026-61614SolidInvoice's long-lived API tokens accepted as URL query parameters, exposing credentials in server logs and browser historySolidInvoice · SolidInvoice · CVSS 5.9 · 2026-09-04 | 5.9 | 0.4% | 2026-09-04 |
| CVE-2025-56551An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with arbitrary attacker-controlled content vi…Directadmin · Directadmin · CVSS 8.2 · 2025-10-03 | 8.2 | 0.4% | 2025-10-03 |
| CVE-2025-41772wwwupdate.cgi Session token in URLMBS · UBR-01 Mk II · CVSS 7.5 · 2026-03-09 | 7.5 | 0.4% | 2026-03-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.