Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Session Fixation in Vvveb CMS v1.0.6.1 Author: Andrew Paul Date of Discovery: June 9th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.6.1 and likely prior versions CVE ID: CVE-2025-8517 Summary A Session Fixation vulnerability...

CVE-2025-55668

CVE-2025-55668 Apache Tomcat - Session fixation via rewrite valve...

PoC-RCE-Rukovoditel

PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...

CVE-2026-55682 WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DBHOST as the cookie domain. If a victim authenticates while using the attacker-selected...

CVE-2026-55682

The WeGIA web manager for charitable institutions is vulnerable to session fixation and information disclosure in versions prior to 3.8.6 . The root cause is located in the auto-prepended web/html/seguranca/sessionStart.php file, which reflects an attacker-supplied PHPSESSID cookie in a Set-Cooki...

CVE-2026-55682 WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DBHOST as the cookie domain. If a victim authenticates while using the attacker-selected...

CVE-2026-107421

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

EUVD-2026-101014

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

CVE-2026-107421 WordPress Broadcast Live Video plugin <= 7.3.2 - Session Hijacking vulnerability

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2...

CVE-2026-107421

The VideoWhisper.com Broadcast Live Video (videowhisper-live-streaming-integration) WordPress plugin, versions up to and including 7.3.2 , is susceptible to a Session Fixation vulnerability (CWE-384). This flaw allows an attacker to perform Session Hijacking , potentially gaining unauthorized acc...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: tomcat (UTSA-2026-130098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130098 advisory. Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41,...

Keycloak SSO Unauthorized Access

The vulnerability of the Single Sign-On SSO authentication mechanism of the Keycloak software for managing identity verification and access control is related to the fixation of the session at the final authorization points. Exploiting this vulnerability could allow a malicious actor to gain...

CVE-2026-63161

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

CVE-2026-63161

The Omnispace Agora Project versions prior to 26.10.0 are susceptible to a session fixation vulnerability (CWE-384). This flaw occurs because the application fails to regenerate the session identifier upon successful authentication. A remote attacker can exploit this by planting a known session i...

CVE-2026-63161 Omnispace Agora Project < 26.10.0 Session Fixation via Authentication

Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability that allows remote attackers to hijack authenticated sessions by planting a known session identifier in a victim's browser prior to login. Attackers can exploit the application's failure to regenerate the session id...

DEBIAN-CVE-2026-107226

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...

CVE-2026-107226

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...

CVE-2026-107226

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...