CVE-2025-71455

The vtenext application, versions prior to 25.02.2 , is vulnerable to a session identifier disclosure in the Touch web service endpoint. This flaw allows an attacker capable of executing scripts within the vtenext origin (e.g., via cross-site scripting ) to read the PHPSESSID value. By accessing ...