MEDIUMCVSS v3.1 5.3Vulnerability
CVE-2025-71455
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-04T21:42:22.291815+00:00
- Cvss score
- 5.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-04T21:43:05+00:00
- Score
- 5.3
- Last source
- NVD
- Cvss version
- 3.1
- Cve id
- CVE-2025-71455
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- First seen by Signal
- 2026-11-04T21:38:26+00:00
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
- Published at
- 2026-11-04T21:17:40.017
- Last modified
- 2026-11-04T21:17:40.017
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph