5301 matches found
Session-Fixation-in-Vvveb-CMS-v1.0.6.1
Session Fixation in Vvveb CMS v1.0.6.1 Author: Andrew Paul Date of Discovery: June 9th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.6.1 and likely prior versions CVE ID: CVE-2025-8517 Summary A Session Fixation vulnerability...
CVE-2025-55668
CVE-2025-55668 Apache Tomcat - Session fixation via rewrite valve...
PoC-RCE-Rukovoditel
PoC-RCE-Rukovoditel Proof of concept for CVE-2020-11819 and CVE-2020-15946. Tested on Rukovoditel 2.4.x, 2.5.x and 2.6.1 Description: This exploit has two modes of execution, using the session fixation vulnerability CVE-2020-15946 or using the access credentials of any account under any profile...
CVE-2026-97890
The Apache TomEE embedded HTTP server is vulnerable to session fixation because it fails to invalidate previous session identifiers when an application changes the session ID (e.g., following a login). This allows an attacker who plants a session identifier in a victim's browser to hijack the vic...
CVE-2026-97890 Apache TomEE: Session fixation in embedded HTTP server
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
CVE-2026-119446
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
EEF-CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Summary Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling...
EUVD-2026-120874
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token
Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling token, a...
CVE-2026-119446
The nerves-hub nerves_hub_web component (versions 2.5.0 to 2.5.2 ) is vulnerable to a Session Fixation vulnerability in its CLI login flow. An unauthenticated attacker can initiate a login via POST /api/auth/cli_session to receive a polling token and a confirmation URL. By persuading a signed-in ...
CVE-2026-125078
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-125078 SourceCodester Smart Attendance System with QR Code Scanner login.php session fixiation
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-125078
A security flaw in the SourceCodester Smart Attendance System with QR Code Scanner 1.0 allows for session fixation . The vulnerability exists in an unspecified part of the login.php file and can be triggered remotely. Public exploits for this vulnerability have been released. No specific remediat...
EUVD-2026-120654
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
PT-2026-141232
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...
CVE-2026-126076: rails: Action Pack is a framework for handling and responding to web requests
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, ActionDispatch::Session::CacheStore writes a session back to the cache at the end of each request that loaded it, without checking that the session's cache entry still exists. When a concurrent...
CVE-2026-97890: Apache Software Foundation Apache TomEE: The embedded HTTP server does not invalidate the previous session identifier when an application changes the session…
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id, e.g. after login. An attacker who can plant a session identifier in a victim's browser can hijack the victim's authenticated session. Users are recommended to block network...
CVE-2026-125078: SourceCodester Smart Attendance System with QR Code Scanner: A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0
A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be us...