CVE-2026-108969 itsmeravitejak Online-Examination-System Session session.php checkLogin comparison

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument...

CVE-2026-108969

A security vulnerability exists in the Session Handler component of the itsmeravitejak Online-Examination-System (up to commit e6208e630b14657999bbfe4c9912302d2a1e2449). The flaw is located in the Session::checkLogin function within the include/session.php file, where manipulation of the cookname...

CVE-2025-48461

CVE-2025-48461 Predictable session cookies that can be bruteforced to gain unauthorized access to Advantech WISE portal Summary During examination of Advantech WISE-4060 web portal, I have discovered that the session cookies used to authenticate to the web portal follows the pattern 60D01EXXXXX...

CVE-2026-89117

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

CVE-2026-76972

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

EUVD-2026-98084

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response...

CVE-2026-89120 Missing authorization check in SAP ABAP Platform

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

EUVD-2026-98199

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests,...

CVE-2026-89120

A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from the FLP . A low-privileged attacker could exploit this by sending specially crafted requests to bypass res...

CVE-2026-89117 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-89117

SAP NetWeaver Enterprise Portal is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). An unauthenticated attacker can inject malicious scripts into a URL parameter , which are reflected in the server response and executed in a victim's browser upon visiting a crafted URL. This can lead to ...

EUVD-2026-98197

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal...

CVE-2026-76972 Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-76972

A Cross-Site Scripting (XSS) vulnerability exists in SAP Manufacturing Integration and Intelligence (CWE-79). The root cause is the improper neutralization of input during web page generation, allowing an attacker to store malicious content that is subsequently rendered by the application. If an ...

EUVD-2026-98185

Due to a Cross-Site Scripting XSS vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed...

CVE-2026-11730: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access such as WiFi credentials to predict valid session identifiers and hijack an authenticated administrator session on the web management portal...

CVE-2026-107371: Insufficient Session Expiration

When the authorize method is called with a maxAge parameter, the auth0.js library does not validate the authtime claim in the resulting ID token against the requested maxAge value. As a result, an application may process an ID token that represents an authentication event older than the requested...

PT-2026-112504

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A use-after-free issue in the Now Playing Session Manager allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption flaw that occurs when an applicati...

CVE-2026-104875: Authorization Bypass Through User-Controlled Key

Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using only its client-supplied recovery-sessi...