Common Weakness Enumeration
CWE-598
AllowedUse of HTTP Request With Sensitive Query String
Abstraction: Variant · Status: Draft
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
163 vulnerabilities reference this CWE, most recent first.
GHSA-PF27-23G4-7WJJ
Vulnerability from github – Published: 2025-03-04 21:30 – Updated: 2025-03-21 18:31
VLAI
Details
Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2021-41719"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-04T21:15:11Z",
"severity": "HIGH"
},
"details": "Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser\u0027s history, referrers, web logs, and other sources.",
"id": "GHSA-pf27-23g4-7wjj",
"modified": "2025-03-21T18:31:34Z",
"published": "2025-03-04T21:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41719"
},
{
"type": "WEB",
"url": "https://cvewalkthrough.com/cve-2021-41719-mseb-ios-application-sensitive-information-exposure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PR6F-5C62-PJ5R
Vulnerability from github – Published: 2025-10-09 15:31 – Updated: 2025-12-04 21:31
VLAI
Details
Potential use of sensitive information in GET requests in Checkmk GmbH's Checkmk versions <2.4.0p13, <2.3.0p38, <2.2.0p46, and 2.1.0 (EOL) may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-32916"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-09T15:16:05Z",
"severity": "LOW"
},
"details": "Potential use of sensitive information in GET requests in Checkmk GmbH\u0027s Checkmk versions \u003c2.4.0p13, \u003c2.3.0p38, \u003c2.2.0p46, and 2.1.0 (EOL) may cause sensitive form data to be included in URL query parameters, which may be logged in various places such as browser history or web server logs.",
"id": "GHSA-pr6f-5c62-pj5r",
"modified": "2025-12-04T21:31:01Z",
"published": "2025-10-09T15:31:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32916"
},
{
"type": "WEB",
"url": "https://checkmk.com/werk/17105"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PWP3-PPXM-VG9C
Vulnerability from github – Published: 2026-09-10 15:33 – Updated: 2026-09-10 15:33
VLAI
Details
Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-88897"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-10T15:17:58Z",
"severity": "HIGH"
},
"details": "Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.",
"id": "GHSA-pwp3-ppxm-vg9c",
"modified": "2026-09-10T15:33:21Z",
"published": "2026-09-10T15:33:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88897"
},
{
"type": "WEB",
"url": "https://github.com/flextype/flextype/issues/598"
},
{
"type": "WEB",
"url": "https://github.com/flextype/flextype"
},
{
"type": "WEB",
"url": "https://github.com/flextype/flextype/blob/v1.0.0-alpha.3/src/flextype/core/Endpoints/Api.php"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/flextype-cms-through-1.0.0-alpha.3-api-token-exposure-via-query-string"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PX37-V4HM-7F6Q
Vulnerability from github – Published: 2024-02-02 03:30 – Updated: 2024-02-02 03:30
VLAI
Details
IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-50328"
],
"database_specific": {
"cwe_ids": [
"CWE-598",
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-02T02:15:16Z",
"severity": "LOW"
},
"details": "IBM PowerSC 1.3, 2.0, and 2.1 may allow a remote attacker to view session identifiers passed via URL query strings. IBM X-Force ID: 275110.\n\n",
"id": "GHSA-px37-v4hm-7f6q",
"modified": "2024-02-02T03:30:32Z",
"published": "2024-02-02T03:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50328"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/275110"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7113759"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q26C-M38M-777F
Vulnerability from github – Published: 2025-04-15 18:31 – Updated: 2025-04-15 21:31
VLAI
Details
In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-24948"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-15T16:16:05Z",
"severity": "MODERATE"
},
"details": "In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records.",
"id": "GHSA-q26c-m38m-777f",
"modified": "2025-04-15T21:31:42Z",
"published": "2025-04-15T18:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24948"
},
{
"type": "WEB",
"url": "https://www.gruppotim.it/it/footer/red-team.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q4MM-2RVG-W8WW
Vulnerability from github – Published: 2022-05-24 19:11 – Updated: 2022-05-24 19:11
VLAI
Details
Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity.
{
"affected": [],
"aliases": [
"CVE-2021-21594"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-16T22:15:00Z",
"severity": "MODERATE"
},
"details": "Dell PowerScale OneFS versions 8.2.2 - 9.1.0.x contain a use of get request method with sensitive query strings vulnerability. It can lead to potential disclosure of sensitive data. Dell recommends upgrading at your earliest opportunity.",
"id": "GHSA-q4mm-2rvg-w8ww",
"modified": "2022-05-24T19:11:28Z",
"published": "2022-05-24T19:11:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21594"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/000190408"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q58Q-2FXH-6W6R
Vulnerability from github – Published: 2024-02-10 00:31 – Updated: 2025-06-03 21:30
VLAI
Details
Sametime is impacted by sensitive information passed in URL.
Severity
{
"affected": [],
"aliases": [
"CVE-2023-45716"
],
"database_specific": {
"cwe_ids": [
"CWE-319",
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-09T22:15:07Z",
"severity": "LOW"
},
"details": "Sametime is impacted by sensitive information passed in URL.",
"id": "GHSA-q58q-2fxh-6w6r",
"modified": "2025-06-03T21:30:33Z",
"published": "2024-02-10T00:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45716"
},
{
"type": "WEB",
"url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0109082"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-Q8RX-4HCF-44W6
Vulnerability from github – Published: 2025-03-17 03:30 – Updated: 2025-03-17 03:30
VLAI
Details
A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-2356"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-17T01:15:37Z",
"severity": "MODERATE"
},
"details": "A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-q8rx-4hcf-44w6",
"modified": "2025-03-17T03:30:23Z",
"published": "2025-03-17T03:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2356"
},
{
"type": "WEB",
"url": "https://github.com/geo-chen/BlackVue/blob/main/README.md#finding-2-hardcoded-secrets-exposed-in-plaintext--client-secrets-sent-via-get"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.299823"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.299823"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-R65G-H7VF-RVR5
Vulnerability from github – Published: 2026-03-20 15:31 – Updated: 2026-03-23 12:30
VLAI
Details
An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-31381"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-20T14:16:14Z",
"severity": "MODERATE"
},
"details": "An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callback URL.",
"id": "GHSA-r65g-h7vf-rvr5",
"modified": "2026-03-23T12:30:29Z",
"published": "2026-03-20T15:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31381"
},
{
"type": "WEB",
"url": "https://communities.gainsight.com/community-news-2/recent-gainsight-assist-plugin-remediations-cve-2026-31381-and-cve-2026-31382-30587"
},
{
"type": "WEB",
"url": "http://www.rapid7.com/blog/post/ve-cve-2026-31381-cve-2026-31382-gainsight-assist-information-disclosure-xss-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-RJJC-74J4-HF2V
Vulnerability from github – Published: 2026-08-11 21:33 – Updated: 2026-08-11 21:33
VLAI
Details
When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-66832"
],
"database_specific": {
"cwe_ids": [
"CWE-598"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-11T21:17:49Z",
"severity": "MODERATE"
},
"details": "When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user\u0027s live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView\u0027s User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.",
"id": "GHSA-rjjc-74j4-hf2v",
"modified": "2026-08-11T21:33:14Z",
"published": "2026-08-11T21:33:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66832"
},
{
"type": "WEB",
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-01.json"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Implementation
When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
No CAPEC attack patterns related to this CWE.