CVE-2026-12581
EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain the user's privilege once the user logs in.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.45%
- CWE
- CWE-384
- Published
- 2026-06-22
- Last modified
- 2026-06-22
Affected products
- Digiwin EasyFlow .NET
Weakness type
Related vulnerabilities
- CVE-2026-64857 — tirreno has Session Fixation in Login Authentication
- CVE-2026-86674 — ningzichun Student Management System login.php session_start session fixiation
- CVE-2026-76196 — Photoshop Mobile | Session Fixation (CWE-384)
- CVE-2026-86279 — SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
- CVE-2026-85238 — Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
- CVE-2026-18527 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].
- CVE-2026-81826 — Flowintel Fails to Invalidate Active Sessions After Password Change
- CVE-2026-70594 — Ghost: Session Fixation in Ghost Admin