Medium 5.9

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows...

CVE-2025-71455 First seen on SecPulse Nov 5, 05:36

Affected packages

Ecosystem	Package	Affected	Fixed
vtenext	vtenext	< 25.02.2	25.02.2

Original description The description as published by the source.

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4: Medium 5.9; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 05:36
GHSA: GHSA-rxq9-mwhc-2q96
CWE: CWE-200

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Cross-Site Scripting

CWE

CWE-200

All

Vtenext

Detection sources

NIST National Vulnerability Database05:17
GitHub Security Advisories (Global)Nov 5, 06:32
CVE.org (CVE Program・cvelistV5)04:24