CVE-2025-59873
Session Token Exposure via URL Query Parameters
- State
- Published
- Severity
- 5.9 Medium
- Published
- Feb 23, 2026
- Updated
- Feb 26, 2026
- Reserved
- Sep 22, 2025
Description
An information exposure vulnerability exists in
Vulnerability in HCL Software ZIE for Web.
The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions
This issue affects ZIE for Web: v16.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.9 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N | HCL |
Weaknesses
- CWE-598 Use of GET Request Method With Sensitive Query Strings
Affected Products
| Product | Versions |
|---|---|
ZIE for WebHCL Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.