PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Fijación de Sesión en Vvveb CMS v1.0.6.1 Autor: Andrew Paul Fecha de Descubrimiento: 9 de junio de 2025 Vendedor: Vvveb URL del Vendedor: http://vvveb.com GitHub del Vendedor: https://github.com/givanz/Vvveb Versión Afectada: 1.0.6.1 y probablemente versiones anteriores ID CVE: CVE-2025-8517...

CVE-2025-55668

CVE-2025-55668 Apache Tomcat - Fijación de sesión mediante la válvula de reescritura...

CVE-2026-64857

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

EUVD-2026-74954

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857

tirreno , a security framework, is affected by a session fixation vulnerability in versions prior to 0.10.0 . During login, tirreno validates credentials and establishes the authenticated session but fails to call session_regenerate_id(), leaving the session identifier unchanged before and after ...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-76196

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

EUVD-2026-74039

A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function sessionstart of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has...

CVE-2026-76196

Photoshop Mobile is affected by a Session Fixation vulnerability (CWE-384) that could result in privilege escalation , allowing an attacker to gain access to sensitive resources. Exploitation requires user interaction — specifically, a victim must interact with a malicious webpage — and additiona...

CVE-2026-76196 Photoshop Mobile | Session Fixation (CWE-384)

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

BIT-JENKINS-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-85238

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

EUVD-2026-70532

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

CVE-2026-84652 is a session fixation vulnerability in Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) . When a user authenticates via the "remember me" cookie, Jenkins does not rotate the session, allowing an attacker serving content on a sibling subdomain (e.g., evil.example.org for Jenkins ...