Loading vulnerability details…
CVSS v3.1
5.3
EPSS
0.35%
Published
Jul 3, 2025
Modified
Jan 29, 2026
Public PoC / Exploit (1)
All weaponized →Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NWeaknesses (CWE)
References (7)