Reliance on Cookies without Validation and Integrity Checking

Every one of the 66 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Palo Alto Networks PAN-OS - Authentication BypassCVE-2026-0257Palo Alto Networks · CVSS 7.8 · 96% likelycovered by CyberSIXT

   Palo Alto NetworksINCk0t9 articles1 article this week: GhostFrame implant enables Settra ransomware attacks on ESXi

2. Cloudpanel 2 < 2.3.1 - Remote Code ExecutionCVE-2023-35885Mgt-Commerce · CVSS 9.8 · 74% likely

   Mgt-Commerce

3. A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10…CVE-2025-64447Fortinet · CVSS 7.1 · 8.9% likely

   Fortinet

4. V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.CVE-2008-5784V3chat · 7.1% likely

   V3 Chat

5. An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacke…CVE-2025-65212Njhyst · CVSS 9.8 · 5.4% likely
6. Linear eMerge 50P/5000P devices allow Authentication Bypass.CVE-2019-7266Nortekcontrol · 4.6% likely

   Nortekcontrol

7. An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.CVE-2017-7279Unitrends · 4.4% likely

   Unitrends

8. An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie.CVE-2022-28113Fantec · 3.7% likely
9. Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Ba…CVE-2017-6896Digisol · 3.7% likely

   Digisol

10. Improperly constrained session cookies in Zoom Client for MeetingsCVE-2022-22785Zoom Video Communications Inc · CVSS 5.9 · 3.5% likely

    Zoom Video Communications, Inc.

11. CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.CVE-2021-41819Ruby-Lang · CVSS 7.5 · 3.2% likely

    Ruby-Lang

12. Reliance on Cookies without Validation and Integrity Checking in getgrav/gravCVE-2021-3818getgrav · CVSS 6.3 · 2.5% likely

    Getgrav

13. In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.CVE-2019-17104Centreon · 1.9% likely

    Centreon

14. ipa 3.0 does not properly check server identity before sending credential containing cookiesCVE-2012-5631ipa · 1.8% likely
15. EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.CVE-2018-20512Cdatatec · 1.8% likely

    Cdatatec

16. A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows…CVE-2018-5455Moxa · 1.6% likely

    Moxa

17. IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.CVE-2019-4305IBM · CVSS 5.3 · 1.5% likely

    IBM

18. Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attac…CVE-2022-1148GitLab · CVSS 5.3 · 1.5% likely

    GitLab

19. Sunhillo SureLine Authentication Bypass via Session CookieCVE-2026-112352Sunhillo Corporation · CVSS 9.1 · 1.5% likely

    Sunhillo Corporation

20. Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified…CVE-2011-3887Google · 1.5% likely

    Google

21. PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.p…CVE-2018-5190Picturespro · 1.4% likely

    Picturespro

22. UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.CVE-2022-38297Ucms Project · 1.3% likely

    Ucms Project

23. ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentCVE-2022-36032reactphp · CVSS 5.3 · 1.2% likely
24. IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in…CVE-2019-4330IBM · CVSS 3.1 · 1.1% likely

    IBM

25. IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a…CVE-2020-4749IBM · CVSS 4.3 · 1.0% likely

    IBM

26. An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.CVE-2018-19224Laobancms · 1.0% likely

    Laobancms

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.