CVE-2026-95828

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-22

Last updated on: 2026-09-23

Assigner: VulDB

Description

A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-23

Generated

2026-10-13

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-95828

EUVD

EUVD-2026-84979

Affected Vendors & Products

Vendor	Product	Version / Range
Mstfakts	College-Management-System	82ab01d057d96c8893c419cd9cb6870120faaea3
Mstfakts	College-Management-System	a37300648b6e50d43a2f10392ad741d199635daf
Mstfakts	College-Management-System	c81bbedea4d9e0b860ac368aa1dbb10e55ceddce

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability is a session fixation issue in the Mstfakts College-Management-System. It exists in the session_start function of the Front-end/server.php file, specifically in the Authentication component. An attacker can manipulate session tokens to gain unauthorized access by fixing a user's session ID before authentication.

Detection Guidance

The vulnerability involves session fixation in Mstfakts College-Management-System due to a flaw in the session_start function of Front-end/server.php. To detect it, monitor for unusual session token reuse or unexpected session behavior. Check server logs for repeated session IDs or unauthorized access attempts. No specific commands are provided in the context.

Impact Analysis

An attacker could hijack a user's session after login by fixing the session ID beforehand. This may allow unauthorized access to sensitive data or administrative functions in the system. The attack is remote and requires user interaction, making it exploitable without direct network access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable or restrict access to the affected component Front-end/server.php in Mstfakts College-Management-System until a patch is available. Monitor authentication logs for unusual session activity or fixations. Consider implementing additional session validation mechanisms.

Hi! I’m here to help you understand CVE-2026-95828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70