Skip to content
OpenAdvisories

Weakness (CWE)

CWE-598: Use of HTTP Request With Sensitive Query String

Variant Draft

The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

How to prevent it (1 mitigation)

  1. Implementation

    When sending sensitive information, only
    include it in the request body or request headers
    instead of the query string. This may require avoiding
    use of GET requests.

Source: MITRE CWE-598

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2025-50110 Public exploit

    An issue was discovered in the method push.lite.avtech.com.AvtechLib.GetHttpsResponse in AVTECH EagleEyes Lite 2.0.0, t…

  • Medium 6.2
    CVE-2025-1738 Public exploit

    Multiple vulnerabilities in Trivision Camera NC227WF

    A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive information to a third party.

    Trivision Camera NC227WF
  • High 7.5
    CVE-2023-6020 Public exploit EPSS 15%

    Ray Static File Local File Include

    LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication.

    ray-project ray-project/ray ray PyPI