CWE-598

CWE-598 · 7 records · 5 with a public proof-of-concept

Records the NVD classes under CWE-598, highest CVSS first.

  1. HIGH 8.8CVE-2026-107807public PoC2026-10-09

    Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret head…

    AI risk analysis on Exploit-DB.ai →

  2. HIGH 7.4CVE-2026-148382026-08-04

    Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

    AI risk analysis on Exploit-DB.ai →

  3. MEDIUM 5.3CVE-2026-123808public PoC2026-11-09

    Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.p…

    AI risk analysis on Exploit-DB.ai →

  4. MEDIUM 5.3CVE-2026-107370public PoC2026-10-13

    When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as q…

    AI risk analysis on Exploit-DB.ai →

  5. LOW 2.6CVE-2026-1088082026-10-12

    A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument …

    AI risk analysis on Exploit-DB.ai →

  6. UNSCOREDCVE-2026-113669public PoC2026-10-20

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and…

    AI risk analysis on Exploit-DB.ai →

  7. UNSCOREDCVE-2026-81632public PoC2026-09-17

    Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successf…

    AI risk analysis on Exploit-DB.ai →