CVE-2025-49189

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1004

Affected software

No affected versions have been published.

Timeline

Published: Jun 12, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-49198.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was CVE-2025-491905.8The application is vulnerable to Server-Side Request Forgery (SSRF). An endpoint can be used to send server internal requests to other ports CVE-2025-491916.1Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution. The URLs get embedded as iFrame widgets, CVE-2025-491926.1The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user CVE-2025-491936.1The application fails to implement several security headers. These headers help increase the overall security level of the web application b CVE-2025-491947.5The server supports authentication methods in which credentials are sent in plaintext over unencrypted channels. If an attacker were to inte CVE-2025-491959.8The FTP server’s login mechanism does not restrict authentication attempts, allowing an attacker to brute-force user passwords and potential CVE-2025-491969.1A service supports the use of a deprecated and unsafe TLS version. This could be exploited to expose sensitive information, modify data in u CVE-2025-491977.5The application uses a weak password hash function, allowing an attacker to crack the weak password hash to gain access to an FTP user accou CVE-2025-491987.5The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by c CVE-2025-491999.8The backup ZIPs are not signed by the application, leading to the possibility that an attacker can download a backup ZIP, modify and re-uplo CVE-2025-492007.5The created backup files are unencrypted, making the application vulnerable for gathering sensitive information by downloading and decompres