CVE-2025-71455mediumCWE-200

CVE-2025-71455: medium-severity vulnerability in vtenext

vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service

Published · Updated

Follow this CVE+ Monitor vtenext

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.9epss 0.3%
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
vtenext · vtenext
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — vtenext

In the same product, most dangerous first.

CVE-2025-71457CRITICALvtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.phpEPSS 0.4%CVE-2025-71456HIGHvtenext before 25.02.2 SQL Injection via fieldname in Fax EditViewEPSS 0.3%CVE-2025-71453MEDIUMvtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockListEPSS 0.2%CVE-2025-71454MEDIUMvtenext before 25.02.2 CSRF Protection Bypass via HTTP Method TamperingEPSS 0.2%