CWE-1004 · Misconfiguration and Insecure Design
Sensitive Cookie Without 'HttpOnly' Flag
35CVEs
0exploited
1with a public check
0likely (EPSS 10%+)
SortMost likely exploited
35 CVEs with CWE-1004 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2025-27223CheckTRUfusion Enterprise <= 7.10.4.0 - Authentication BypassRocketsoftware · Trufusion Enterprise · CVSS 7.5 · 2025-10-27 | 7.5 | 2.2% | 2025-10-27 |
| CVE-2020-27658Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obt…Synology · Synology Router Manager (SRM) · CVSS 7.1 · 2020-10-29 | 7.1 | 1.3% | 2020-10-29 |
| CVE-2021-42115Missing HTTPOnly flag on sensitive cookie in TopEaseBusiness-DNA Solutions GmbH · TopEase · CVSS 8.1 · 2021-11-30 | 8.1 | 1.3% | 2021-11-30 |
| CVE-2019-8283Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag. This allows malicious javascript to steal it.Gemalto · Sentinel LDK RTE · 2019-06-07 | – | 1.2% | 2019-06-07 |
| CVE-2021-3706Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminltepi-hole · pi-hole/adminlte · CVSS 7.4 · 2021-09-15 | 7.4 | 1.1% | 2021-09-15 |
| CVE-2022-25172An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4. The session cookie misses the HttpOnly flag…InHand Networks · InRouter302 · CVSS 7.5 · 2022-05-12 | 7.5 | 1.0% | 2022-05-12 |
| CVE-2021-39210Autologin cookie accessible by scriptsglpi-project · glpi · CVSS 6.5 · 2021-09-15 | 6.5 | 1.0% | 2021-09-15 |
| CVE-2020-6267Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only flag.SAP SE · SAP Disclosure Management · CVSS 6.3 · 2020-07-14 | 6.3 | 0.8% | 2020-07-14 |
| CVE-2022-4630Sensitive Cookie Without 'HttpOnly' Flag in lirantal/daloradiuslirantal · lirantal/daloradius · CVSS 5.3 · 2022-12-21 | 5.3 | 0.7% | 2022-12-21 |
| CVE-2019-25091nsupdate.info CSRF Cookie base.py cookie httponly flagNsupdate · nsupdate.info · CVSS 3.7 · 2022-12-27 | 3.7 | 0.7% | 2022-12-27 |
| CVE-2022-21939Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)Johnson Controls · System Configuration Tool (SCT) · CVSS 7.5 · 2023-02-09 | 7.5 | 0.5% | 2023-02-09 |
| CVE-2026-127276Linksys EA8100 Web UI cookie httponly flagLinksys · EA8100 · CVSS 3.7 · 2026-11-13 | 3.7 | 0.5% | 2026-11-13 |
| CVE-2024-41685Cookie Without HTTPOnly Flag Set VulnerabilitySyroTech · SyroTech SY-GPON-1110-WDONT router · CVSS 6.9 · 2024-07-26 | 6.9 | 0.5% | 2024-07-26 |
| CVE-2026-82697sambitraj Student-Management-System session_start cookie httponly flagsambitraj · Student-Management-System · CVSS 3.7 · 2026-08-31 | 3.7 | 0.5% | 2026-08-31 |
| CVE-2025-0479Security Misconfiguration Vulnerability in CP Plus RouterCP Plus · CP-XR-DE21-S Router · CVSS 8.6 · 2025-01-20 | 8.6 | 0.5% | 2025-01-20 |
| CVE-2024-6739Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' FlagOpenfind · MailGates · CVSS 5.3 · 2024-07-15 | 5.3 | 0.4% | 2024-07-15 |
| CVE-2025-26844An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.Znuny · Znuny · CVSS 9.8 · 2025-05-08 | 9.8 | 0.4% | 2025-05-08 |
| CVE-2025-27453CVE-2025-27453Endress+Hauser · Endress+Hauser MEAC300-FNADE4 · CVSS 5.3 · 2025-07-03 | 5.3 | 0.4% | 2025-07-03 |
| CVE-2022-33167IBM Security Directory Integrator information disclosureIBM · Security Directory Integrator · CVSS 3.7 · 2024-07-30 | 3.7 | 0.4% | 2024-07-30 |
| CVE-2022-43845IBM Aspera Console information disclosureIBM · Aspera Console · CVSS 3.7 · 2024-09-24 | 3.7 | 0.4% | 2024-09-24 |
| CVE-2026-53660OpenAM Insecure SSO Cookie InitializationOpenIdentityPlatform · OpenAM · CVSS 7.4 · 2026-09-15 | 7.4 | 0.4% | 2026-09-15 |
| CVE-2026-0696Session Cookies Missing HttpOnly AttributeConnectWise · PSA · CVSS 6.5 · 2026-01-16 | 6.5 | 0.4% | 2026-01-16 |
| CVE-2026-22081Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless RoutersTenda · 300Mbps Wireless Router F3 and N300 Easy Setup Router · CVSS 8.8 · 2026-01-09 | 8.8 | 0.4% | 2026-01-09 |
| CVE-2023-4217Session cookies attribute not set properlyMoxa · PT-G503 Series · CVSS 3.1 · 2023-11-02 | 3.1 | 0.4% | 2023-11-02 |
| CVE-2025-24318Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' FlagDario Health · Dario Application Database and Internet-based Server Infrastructure · CVSS 6.8 · 2025-02-28 | 6.8 | 0.4% | 2025-02-28 |
| CVE-2023-4228ioLogik 4000 Series: Session Cookies Attribute Not Set ProperlyMoxa · ioLogik 4000 Series · CVSS 3.1 · 2023-08-24 | 3.1 | 0.3% | 2023-08-24 |
| CVE-2025-49189Cookie missing HttpOnly flagSICK AG · SICK Media Server · CVSS 5.3 · 2025-06-12 | 5.3 | 0.3% | 2025-06-12 |
| CVE-2023-2876Session cookie exposure for client side scriptABB · REX640 PCL1 · CVSS 3.1 · 2023-06-13 | 3.1 | 0.3% | 2023-06-13 |
| CVE-2026-42239Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverBudibase · budibase · CVSS 8.1 · 2026-05-07 | 8.1 | 0.3% | 2026-05-07 |
| CVE-2025-47289Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly FlagCE-PhoenixCart · PhoenixCart · CVSS 6.3 · 2025-06-02 | 6.3 | 0.3% | 2025-06-02 |
| CVE-2025-42909Security Misconfiguration vulnerability in SAP Cloud Appliance Library AppliancesSAP_SE · SAP Cloud Appliance Library Appliances · CVSS 3 · 2025-10-14 | 3.0 | 0.2% | 2025-10-14 |
| CVE-2026-21754HCL Hive is affected by multiple security vulnerabilities.HCL Software · Hive · CVSS 5.4 · 2026-08-25 | 5.4 | 0.2% | 2026-08-25 |
| CVE-2021-34563In WirelessHART-Gateway versions 3.0.8 and 3.0.9 the HttpOnly flag is missing in a cookie which allows client-side javascript to modify itPhoenix Contact · WHA-GW-F2D2-0-AS- Z2-ETH · CVSS 3.3 · 2021-08-31 | 3.3 | 0.2% | 2021-08-31 |
| CVE-2025-12031HTTP Security Misconfiguration - Lacking Secure and HTTPOnly AttributeAzure Access Technology · BLU-IC2 · CVSS 5.3 · 2025-10-21 | 5.3 | 0.2% | 2025-10-21 |
| CVE-2026-57948Pinpoint - Insecure Session Cookie Attributes in pinpointJwtpinpoint-apm · pinpoint · CVSS 6.8 · 2026-06-29 | 6.8 | 0.2% | 2026-06-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.