Session Fixation in QR Menu Pro Panel Enables Session Hijacking

Publication date: 2026-01-29

Last updated on: 2026-06-05

Assigner: Computer Emergency Response Team of the Republic of Turkey

Description

Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-29

Last Modified

2026-06-05

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-7014

EUVD

EUVD-2025-206544

Affected Vendors & Products

Vendor	Product	Version / Range
qrmenumpro	menu_panel	29012026

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability is a Session Fixation issue in QR Menu Pro Smart Menu Systems Menu Panel, which allows an attacker to hijack a user's session. Essentially, an attacker can fixate a user's session ID and then take over the session, gaining unauthorized access.

Impact Analysis

The vulnerability can lead to session hijacking, allowing attackers to impersonate legitimate users without their consent. This can result in unauthorized access to user accounts or sensitive information.

Hi! I’m here to help you understand CVE-2025-7014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70