Weaknesses of type CWE-598

98 results

Transmissão de dados sensíveis em query string de requisição HTTP

A aplicação envia informações confidenciais (senhas, tokens, dados pessoais) como parâmetros na URL em vez de no corpo da requisição. O problema: query strings são registradas em logs do servidor, histórico do navegador, proxies e podem ser capturadas em tráfego não-HTTPS, expondo credenciais ou dados privados.

Example

Um formulário de login que faz GET em `/login?user=joao@email.com&password=senha123` em vez de POST. A URL fica visível no histórico do navegador, nos logs do servidor web e em qualquer proxy intermediário, permitindo recuperação posterior da credencial.

How to mitigate

Use POST ou PUT com o corpo da requisição para dados sensíveis; sempre force HTTPS; nunca passe credenciais, tokens ou dados pessoais como parâmetros de URL. Configure o servidor para não logar query strings de endpoints de autenticação e use a flag Secure + HttpOnly em cookies.

CVE-2024-9877MEDIUMSensitive information submitted using GET methodEPSS 0.2%CVE-2026-14838HIGHSession Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2025-14811LOWIBM Sterling Partner Engagement Manager Information DisclosureEPSS 0.2%CVE-2026-10078LOWQuay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystringEPSS 0.2%CVE-2025-51651MEDIUMAn authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbiEPSS 0.2%CVE-2025-32916LOWSensitive form data in URL query parametersEPSS 0.2%CVE-2025-31954MEDIUMHCL iAutomate is susceptible to a sensitive information disclosureEPSS 0.2%CVE-2024-2745LOWRapid7 InsightVM Sensitive Information Exposure via URLEPSS 0.2%CVE-2025-1738MEDIUMMultiple vulnerabilities in Trivision Camera NC227WFEPSS 0.2%CVE-2026-27949LOWPlane Exposes User Email (PII and part of credential) in GET ParameterEPSS 0.2%CVE-2026-82181MEDIUMLe-yan｜Medical Practice Management System - Sensitive Data in URLEPSS 0.2%CVE-2026-81632HIGHSingle-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixEPSS 0.2%CVE-2025-69634CRITICALCross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field EPSS 0.1%CVE-2025-54542MEDIUMSending Password in GET RequestEPSS 0.1%CVE-2023-45716LOWHCL Sametime is impacted by a sensitive information disclosureEPSS 0.1%CVE-2025-62317LOWHCL AION is affected by a vulnerability where sensitive information may be included in URL parameters.EPSS 0.1%CVE-2026-47768MEDIUMnebula-mesh: Newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs)EPSS 0.1%CVE-2026-2237MEDIUMA use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1EPSS 0.1%