5292 matches found
CVE-2026-97890
The Apache TomEE embedded HTTP server is vulnerable to session fixation because it fails to invalidate previous session identifiers when an application changes the session ID (e.g., following a login). This allows an attacker who plants a session identifier in a victim's browser to hijack the vic...
CVE-2026-97890 Apache TomEE: Session fixation in embedded HTTP server
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
EEF-CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Summary Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling...
CVE-2026-119446
The nerves-hub nerves_hub_web component (versions 2.5.0 to 2.5.2 ) is vulnerable to a Session Fixation vulnerability in its CLI login flow. An unauthenticated attacker can initiate a login via POST /api/auth/cli_session to receive a polling token and a confirmation URL. By persuading a signed-in ...
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-125078
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-125078 SourceCodester Smart Attendance System with QR Code Scanner login.php session fixiation
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-125078
A security flaw in the SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows for session fixation . The vulnerability exists in an unspecified part of the login.php file and can be triggered remotely. Public exploits for this vulnerability have been released. No specific remediat...
EUVD-2026-120654
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
PT-2026-141232
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-125078: SourceCodester Smart Attendance System with QR Code Scanner: A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-97890: Apache Software Foundation Apache TomEE: The embedded HTTP server does not invalidate the previous session identifier when an application changes the session…
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
CVE-2026-8639
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...
EUVD-2026-119734
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...
CVE-2026-8639
IBM Security Verify Directory versions 10.0.0 through 10.0.4 and IBM Verify Directory version 11.0.0 are vulnerable to session fixation (CWE-384). An attacker can establish a session and hijack it after a victim authenticates, leading to unauthorized access to the directory management console. To...
CVE-2026-8639 IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...
login-range
login-range A self-contained attack range for login pages...
CVE-2026-8639: IBM: IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...
PT-2026-140143
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console...
