CVE-2025-7014
Unknown
Unknown - Not Provided
Session Fixation in QR Menu Pro Panel Enables Session Hijacking
Publication date: 2026-01-29
Last updated on: 2026-03-09
Assigner: Computer Emergency Response Team of the Republic of Turkey
Description
Description
Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking.This issue affects Menu Panel: through 29012026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qrmenumpro | menu_panel | 29012026 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-384 | Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Session Fixation issue in QR Menu Pro Smart Menu Systems Menu Panel, which allows an attacker to hijack a user's session. Essentially, an attacker can fixate a user's session ID and then take over the session, gaining unauthorized access.
How can this vulnerability impact me? :
The vulnerability can lead to session hijacking, allowing attackers to impersonate legitimate users without their consent. This can result in unauthorized access to user accounts or sensitive information.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70