Skip to content
OpenAdvisories

Weakness (CWE)

CWE-598: Use of HTTP Request With Sensitive Query String

Variant Draft

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

How to prevent it (1 mitigation)

  1. Implementation

    When sending sensitive information, only
    include it in the request body or request headers
    instead of the query string. This may require avoiding
    use of GET requests.

Source: MITRE CWE-598

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-76179

    Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

    An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker wi…

    Ebyte Ebyte NA111-M Firmware
  • Critical 9.8
    CVE-2026-74880

    openssl_encrypt before 1.4.0 Token Leakage via Query Parameters

    openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.

    jahlives openssl_encrypt openssl-encrypt PyPI
  • Critical 9.0
    CVE-2025-69634

    Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges…

  • Critical 9.1
    CVE-2023-6014

    MLflow Authentication Bypass

    An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.

    MLflow mlflow/mlflow mlflow PyPI