CVE-2026-108969
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 in the Session::checkLogin function of include/session.php in the Session Handler component. Manipulation of cookname/cookid arguments leads to incorrect comparison. The attack can be executed remotely and the exploit is public. The project has not responded.
Risk Assessment
The risk involves potential remote bypass of the login mechanism, which could allow unauthorized access to user sessions and exam data.
Recommendation
It is recommended to apply patches immediately or temporarily disable the login function, and use secure session data comparison mechanisms.
Other vulnerabilities in itsmeravitejak Online-Examination-System
Original NVD description (English source)
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS