CWE-598— Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.— MITRE CWE catalog
103 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-598page 3 of 3
- CVE-2024-28238LOWCVSS 2.3EG 2.32024-03-12
Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various …
- CVE-2025-32021LOWCVSS 2.2EG 2.22025-04-15
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is included in the client's URL parameters duri…
- CVE-2023-45716LOWCVSS 1.7EG 1.72024-02-09
Sametime is impacted by sensitive information passed in URL.
Map vulnerabilities like CWE-598 to your infrastructure
EchelonGraph correlates every CVE — across CWE-598 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →