CVE-2026-95828
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A vulnerability was determined in Mstfakts College-Management-System affecting the session_start function in Front-end/server.php within the Authentication component. Manipulation leads to session fixation. The attack can be launched remotely and the exploit has been publicly disclosed. The product uses rolling releases, so version details are unavailable. The project was informed but has not responded.
Risk Assessment
An attacker can hijack a user session, potentially leading to unauthorized access to the application in the victim's context.
Recommendation
Monitor the project for a patch; until then, consider implementing additional session protection mechanisms.
Other vulnerabilities in College-Management-System
Original NVD description (English source)
A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS