Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Vvveb CMS v1.0.6.1 中的会话固定漏洞 作者： Andrew Paul 发现日期： 2025年6月9日 厂商： Vvveb 厂商URL： http://vvveb.com 厂商GitHub： https://github.com/givanz/Vvveb 受影响版本： 1.0.6.1（可能包括更早版本） CVE ID： CVE-2025-8517 摘要 在Vvveb CMS 1.0.6.1版本的认证机制中发现了一个会话固定漏洞，分类为CWE-384:...

CVE-2025-55668

CVE-2025-55668 Apache Tomcat - 通过重写阀的会话固定...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel 针对 CVE-2020-11819 和 CVE-2020-15946 的概念验证。已在 Rukovoditel 2.4.x、2.5.x 和 2.6.1 上测试。 描述： 此漏洞利用工具有两种执行模式：一种是利用会话固定漏洞（CVE-2020-15946），另一种是利用任意配置文件下任意账户的访问凭据。 使用 --type L 选项时，该脚本会创建一个恶意链接，如果受害者在浏览器中访问该链接，将设置一个任意的会话标识符，用于在其头像上传带有 PHP 内容的图片后窃取其会话，然后利用本地文件包含（CVE-2020-11819）获得一个反向...

MDaemon-Advisories

MDaemon 安全公告 MDaemon 公告： CVE-2021-27180（反射型 XSS） CVE-2021-27181（CSRF Token 固定） CVE-2021-27182（Iframe 注入） CVE-2021-27183（远程代码执行） 这些漏洞已于 2021 年 1 月修复，并已作为 CVE 公开。它们可以组合利用，通过电子邮件消息实现远程代码执行/帐户接管（需要用户交互）。 时间线： 2020 年 12 月 15 日：向供应商提交漏洞报告 2021 年 1 月 12 日：发布补丁 补丁说明：...

CVE-2026-64857

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

EUVD-2026-74954

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857 tirreno has Session Fixation in Login Authentication

tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call sessionregenerateid afterward. As a result, the session identifier is not rotate...

CVE-2026-64857

tirreno , a security framework, is affected by a session fixation vulnerability in versions prior to 0.10.0 . During login, tirreno validates credentials and establishes the authenticated session but fails to call session_regenerate_id(), leaving the session identifier unchanged before and after ...

aegis-latent-core

Aegis Latent Core AI Governance and Cryptographic Evidence Gateway Aegis sits between your application and your model provider. For every governed call it applies policy, forwards the request, and commits a signed, hash-linked evidence record before the response reaches your caller — together wit...

CVE-2026-76196

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

EUVD-2026-74039

A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function sessionstart of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has...

CVE-2026-76196

Photoshop Mobile is affected by a Session Fixation vulnerability (CWE-384) that could result in privilege escalation , allowing an attacker to gain access to sensitive resources. Exploitation requires user interaction — specifically, a victim must interact with a malicious webpage — and additiona...

CVE-2026-76196 Photoshop Mobile | Session Fixation (CWE-384)

Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain access to sensitive resources. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue requires user...

BIT-JENKINS-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-85238

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-85238

MISP contains a session fixation vulnerability in its CustomAuth authentication flow (a custom configuration). The root cause is that __customAuthentication() wrote the authenticated user into the existing CakePHP session without first calling Session->renew(), which had been disabled. An atta...

CVE-2026-85238 Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

EUVD-2026-70532

MISP contains a session fixation vulnerability in the CustomAuth authentication a custom configuration flow. When a user was successfully authenticated through CustomAuth, MISP stored the authenticated user identity in the existing session without first rotating the session identifier. As a resul...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...