Skip to main content

Use of GET Request Method With Sensitive Query Strings

CVE-2025-51651

Medium
5.5/10

Summary

An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • LOW
  • LOW
  • LOW

CWE-598 - Use of GET Request Method With Sensitive Query Strings

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

References

Advisory Timeline

  • Published