CVE-2026-95828

Received Received - Intake

Session Fixation in Mstfakts College-Management-System

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: VulDB

Description

A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-95828

EUVD

EUVD-2026-84979

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-384	Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Attack-Flow Graph

Executive Summary

This vulnerability is a session fixation issue in the Mstfakts College-Management-System. It exists in the session_start function of the Front-end/server.php file, specifically in the Authentication component. An attacker can manipulate session tokens to gain unauthorized access by fixing a user's session ID before authentication.

Impact Analysis

An attacker could hijack a user's session after login by fixing the session ID beforehand. This may allow unauthorized access to sensitive data or administrative functions in the system. The attack is remote and requires user interaction, making it exploitable without direct network access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Disable or restrict access to the affected component Front-end/server.php in Mstfakts College-Management-System until a patch is available. Monitor authentication logs for unusual session activity or fixations. Consider implementing additional session validation mechanisms.

Hi! I’m here to help you understand CVE-2026-95828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70