609 matches found
CVE-2026-121498
The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address...
EUVD-2026-124277
The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address...
CVE-2026-97890
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
CVE-2026-97890
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
EUVD-2026-121257
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
PT-2026-141793
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
CVE-2025-71455
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...
EUVD-2025-211253
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...
CVE-2025-71455
The vtenext application, versions prior to 25.02.2 , is vulnerable to a session identifier disclosure in the Touch web service endpoint. This flaw allows an attacker capable of executing scripts within the vtenext origin (e.g., via cross-site scripting ) to read the PHPSESSID value. By accessing ...
CVE-2025-71455 vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...
PT-2026-137121
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and...
EUVD-2026-114392
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had...
Security Bulletin: TS4500 Tape Library addresses security vulnerability CVE-2025-36252
Summary The Web UI did not generate a new session identifier following successful user authentication, allowing a pre-authentication session identifier to remain associated with the authenticated session. An attacker who could obtain or cause a user's browser to use a known session identifier...
CVE-2026-106119
LangChain is a framework for building LLM-powered applications. Prior to 1.3.1, MongoDBChatMessageHistory does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing the identifier to be interpreted as a MongoDB query condition rather than as a...
CVE-2026-66249
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...
PT-2026-103867
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...
CVE-2026-84652
A flaw was found in Jenkins. When a user authenticates using the "remember me" cookie, Jenkins fails to rotate the session identifier. This oversight allows a remote attacker, who can serve content on the same site as Jenkins, to set a known session cookie in a victim's browser. Consequently, onc...
CVE-2026-100671 Grav before 2.0.25 Session Cookie Theft via Twig Sandbox
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists getcookie, which returns a...
Session Fixation
Overview Affected versions of this package are vulnerable to Session Fixation through the reuse of a session identifier retained across successful authentication. An attacker can gain unauthorized access to an authenticated management session by exploiting the lack of HTTP session renewal after...
CVE-2026-85496
The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session...