CVE-2026-78188
— UNSCOREDPublished 2026-10-31 · Updated 2026-10-31
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it.
Weaknesses
CWE-614, CWE-1004, CWE-1275
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-115519
- MEDIUMCVE-2026-107229PoC
- UNSCOREDCVE-2026-107280PoC
- UNSCOREDCVE-2026-111063PoC
- LOWCVE-2026-56599
- HIGHCVE-2026-61687PoC
- LOWCVE-2026-66249
Related by shared AI tags and CWE weakness class. Browse the full archive.