CWE-598
Use of HTTP Request With Sensitive Query String
Description
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
Hierarchy (View 1000)
Parents
Children
none
CVEs mapped to this weakness (92)
page 5 of 5| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-45716 | Low | 0.11 | 1.7 | 0.00 | Feb 9, 2024 | Sametime is impacted by sensitive information passed in URL. | ||
| CVE-2026-27949 | Low | 0.06 | 2.0 | 0.00 | Apr 7, 2026 | Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted).… | ||
| CVE-2026-14838 | Hig | 0.00 | 7.4 | 0.00 | Aug 4, 2026 | Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||
| CVE-2026-16207 | Low | 0.00 | 3.7 | 0.00 | Jul 19, 2026 | A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This… | ||
| CVE-2026-15322 | Hig | 0.00 | 7.5 | 0.00 | Jul 17, 2026 | IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs. | ||
| CVE-2026-9592 | Hig | 0.00 | — | 0.00 | Jul 17, 2026 | SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header. | ||
| CVE-2026-62386 | Hig | 0.00 | 7.5 | 0.00 | Jul 17, 2026 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server… | ||
| CVE-2026-54652 | Hig | 0.00 | 8.1 | 0.00 | Jul 8, 2026 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request… | ||
| CVE-2026-58656 | Hig | 0.00 | 7.5 | 0.00 | Jul 8, 2026 | Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain… | ||
| CVE-2026-55375 | — | 0.00 | — | — | Jun 19, 2026 | ## Summary In affected versions, the OAuth2 token request sends `app_id`, `app_secret`, `refresh_token` and `code` as URL query parameters of the POST request to `https://oauth./oauth/api/oauth2/token`. Request URLs are commonly recorded in access logs, proxy… | ||
| CVE-2026-23846 | Hig | 0.00 | 8.1 | 0.00 | Jan 19, 2026 | Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs… | ||
| CVE-2025-57800 | Hig | 0.00 | 8.8 | 0.00 | Aug 22, 2025 | Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary… |
- risk 0.11cvss 1.7epss 0.00
Sametime is impacted by sensitive information passed in URL.
- risk 0.06cvss 2.0epss 0.00
Plane is an an open-source project management tool. Prior to 1.3.0, a vulnerability was identified in Plane's authentication flow where a user's email address is included as a query parameter in the URL during error handling (e.g., when an invalid magic code is submitted).…
- risk 0.00cvss 7.4epss 0.00
Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.
- risk 0.00cvss 3.7epss 0.00
A vulnerability was detected in django-tastypie up to 0.15.1. Impacted is the function ApiKeyAuthentication of the file tastypie/authentication.py. The manipulation results in use of get request method with sensitive query strings. The attack can be launched remotely. This…
- risk 0.00cvss 7.5epss 0.00
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs.
- risk 0.00cvss —epss 0.00
SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.
- risk 0.00cvss 7.5epss 0.00
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server…
- risk 0.00cvss 8.1epss 0.00
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request…
- risk 0.00cvss 7.5epss 0.00
Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain…
- CVE-2026-55375Jun 19, 2026risk 0.00cvss —epss —
## Summary In affected versions, the OAuth2 token request sends `app_id`, `app_secret`, `refresh_token` and `code` as URL query parameters of the POST request to `https://oauth./oauth/api/oauth2/token`. Request URLs are commonly recorded in access logs, proxy…
- risk 0.00cvss 8.1epss 0.00
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs…
- risk 0.00cvss 8.8epss 0.00
Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback URLs during OIDC authentication. An attacker can craft a login link that causes Audiobookshelf to store an arbitrary…