CWE-565 · Access Control
Reliance on Cookies without Validation and Integrity Checking
66CVEs
SortMost likely exploited
66 CVEs with CWE-565 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-0257In CISA KEVExploitedPalo Alto Networks PAN-OS - Authentication BypassPalo Alto Networks · Cloud NGFW · CVSS 7.8 · 2026-05-13 | 7.8 | 96% | 2026-05-13 |
| CVE-2023-35885CheckCloudpanel 2 < 2.3.1 - Remote Code ExecutionMgt-Commerce · Cloudpanel · CVSS 9.8 · 2023-06-20 | 9.8 | 74% | 2023-06-20 |
| CVE-2025-64447A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10…Fortinet · FortiWeb · CVSS 7.1 · 2025-12-09 | 7.1 | 8.9% | 2025-12-09 |
| CVE-2008-5784V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.V3chat · V3 Chat Profiles Dating Script · 2008-12-31 | – | 7.1% | 2008-12-31 |
| CVE-2025-65212An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacke…Njhyst · Hy511 Firmware · CVSS 9.8 · 2026-01-06 | 9.8 | 5.4% | 2026-01-06 |
| CVE-2019-7266Linear eMerge 50P/5000P devices allow Authentication Bypass.Nortekcontrol · Linear Emerge 50p Firmware · 2019-07-02 | – | 4.6% | 2019-07-02 |
| CVE-2017-7279An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login.Unitrends · Enterprise Backup · 2017-04-12 | – | 4.4% | 2017-04-12 |
| CVE-2022-28113An issue in upload.csp of FANTEC GmbH MWiD25-DS Firmware v2.000.030 allows attackers to write files and reset the user passwords without having a valid session cookie.Fantec · Mwid25-Ds Firmware · 2022-04-15 | – | 3.7% | 2022-04-15 |
| CVE-2017-6896Privilege escalation vulnerability on the DIGISOL DG-HR1400 1.00.02 wireless router enables an attacker to escalate from user privilege to admin privilege just by modifying the Ba…Digisol · Dg-Hr1400 Router Firmware · 2017-03-14 | – | 3.7% | 2017-03-14 |
| CVE-2022-22785Improperly constrained session cookies in Zoom Client for MeetingsZoom Video Communications Inc · Zoom Client for Meetings for Android · CVSS 5.9 · 2022-05-18 | 5.9 | 3.5% | 2022-05-18 |
| CVE-2021-41819CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.Ruby-Lang · Cgi · CVSS 7.5 · 2022-01-01 | 7.5 | 3.2% | 2022-01-01 |
| CVE-2021-3818Reliance on Cookies without Validation and Integrity Checking in getgrav/gravgetgrav · getgrav/grav · CVSS 6.3 · 2021-09-27 | 6.3 | 2.5% | 2021-09-27 |
| CVE-2019-17104In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.Centreon · Centreon Vm · 2019-10-08 | – | 1.9% | 2019-10-08 |
| CVE-2012-5631ipa 3.0 does not properly check server identity before sending credential containing cookiesipa · ipa · 2019-11-25 | – | 1.8% | 2019-11-25 |
| CVE-2018-20512EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies.Cdatatec · Epon Cpe-Wifi Devices Firmware · 2019-01-03 | – | 1.8% | 2019-01-03 |
| CVE-2018-5455A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The application allows…Moxa · Moxa OnCell G3100-HSPA Series · 2018-03-05 | – | 1.6% | 2018-03-05 |
| CVE-2019-4305IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information caused by the improper setting of a cookie. IBM X-Force ID: 160951.IBM · WebSphere Application Server · CVSS 5.3 · 2019-09-30 | 5.3 | 1.5% | 2019-09-30 |
| CVE-2022-1148Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attac…GitLab · GitLab · CVSS 5.3 · 2022-04-04 | 5.3 | 1.5% | 2022-04-04 |
| CVE-2026-112352Sunhillo SureLine Authentication Bypass via Session CookieSunhillo Corporation · SureLine · CVSS 9.1 · 2026-10-27 | 9.1 | 1.5% | 2026-10-27 |
| CVE-2011-3887Google Chrome before 15.0.874.102 does not properly handle javascript: URLs, which allows remote attackers to bypass intended access restrictions and read cookies via unspecified…Google · Chrome · 2011-10-25 | – | 1.5% | 2011-10-25 |
| CVE-2018-5190PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_head.php, pc_login.p…Picturespro · Picturespro · 2018-04-17 | – | 1.4% | 2018-04-17 |
| CVE-2022-38297UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.Ucms Project · Ucms · 2022-09-12 | – | 1.3% | 2022-09-12 |
| CVE-2022-36032ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sentreactphp · http · CVSS 5.3 · 2022-09-06 | 5.3 | 1.2% | 2022-09-06 |
| CVE-2019-4330IBM Security Guardium Big Data Intelligence (SonarG) 4.0 does not set the secure attribute for cookies in HTTPS sessions, which could cause the user agent to send those cookies in…IBM · Security Guardium Big Data Intelligence · CVSS 3.1 · 2019-10-28 | 3.1 | 1.1% | 2019-10-28 |
| CVE-2020-4749IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a…IBM · Spectrum Scale · CVSS 4.3 · 2020-10-20 | 4.3 | 1.0% | 2020-10-20 |
| CVE-2018-19224An issue was discovered in LAOBANCMS 2.0. /admin/login.php allows spoofing of the id and guanliyuan cookies.Laobancms · Laobancms · 2018-11-12 | – | 1.0% | 2018-11-12 |
| CVE-2014-125112Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code executionMIYAGAWA · Plack::Middleware::Session::Cookie · CVSS 9.8 · 2026-03-26 | 9.8 | 0.9% | 2026-03-26 |
| CVE-2023-32725Leak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.Zabbix · Zabbix · CVSS 9.6 · 2023-12-18 | 9.6 | 0.8% | 2023-12-18 |
| CVE-2020-26955When a user downloaded a file in Firefox for Android, if a cookie is set, it would have been re-sent during a subsequent file download operation on the same domain, regardless of…Mozilla · Firefox · 2020-12-09 | – | 0.8% | 2020-12-09 |
| CVE-2021-29624Lack of protection against cookie tossing attacks in fastify-csrffastify · fastify-csrf · CVSS 6.5 · 2021-05-19 | 6.5 | 0.8% | 2021-05-19 |
| CVE-2026-76186Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityApache Software Foundation · Apache Airflow Keycloak provider · CVSS 9.1 · 2026-09-16 | 9.1 | 0.8% | 2026-09-16 |
| CVE-2025-14440JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookiejayarsiech · JAY Login & Register · CVSS 9.8 · 2025-12-13 | 9.8 | 0.8% | 2025-12-13 |
| CVE-2019-4638IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using ma…IBM · Security Secret Server · CVSS 3.7 · 2020-01-28 | 3.7 | 0.8% | 2020-01-28 |
| CVE-2022-35284IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811.IBM · Security Verify Information Queue · CVSS 5.3 · 2022-07-25 | 5.3 | 0.8% | 2022-07-25 |
| CVE-2022-2615Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google · Chrome · 2022-08-12 | – | 0.8% | 2022-08-12 |
| CVE-2017-8034The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do no…Cloudfoundry · Cloud Foundry · 2017-07-17 | – | 0.8% | 2017-07-17 |
| CVE-2024-1551Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type response header, as well as control part of t…Mozilla · Firefox · CVSS 6.1 · 2024-02-20 | 6.1 | 0.7% | 2024-02-20 |
| CVE-2024-28288Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An attacker can use this vu…Ruijie · Rg-Nbr700gw Firmware · CVSS 9.8 · 2024-03-30 | 9.8 | 0.7% | 2024-03-30 |
| CVE-2023-41084Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity CheckingSocomec · MODULYS GP (MOD3GP-SY-120K) · CVSS 10 · 2023-09-18 | 10.0 | 0.7% | 2023-09-18 |
| CVE-2026-85181CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksumdianping · cat · CVSS 9.8 · 2026-09-03 | 9.8 | 0.7% | 2026-09-03 |
| CVE-2020-15128Reliance on Cookies without validation in OctoberCMSoctobercms · october · CVSS 6.1 · 2020-07-31 | 6.1 | 0.7% | 2020-07-31 |
| CVE-2023-32612Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to exe…WAVLINK TECHNOLOGY Ltd. · WL-WN531AX2 · 2023-06-30 | – | 0.7% | 2023-06-30 |
| CVE-2024-9970NewType FlowMaster BPM Plus - Privilege EscalationNewType · FlowMaster BPM Plus · CVSS 8.8 · 2024-10-15 | 8.8 | 0.6% | 2024-10-15 |
| CVE-2025-2395e-Excellence U-Office Force - Improper Authenticatione-Excellence · U-Office Force · CVSS 9.8 · 2025-03-17 | 9.8 | 0.6% | 2025-03-17 |
| CVE-2019-4688IBM Security Guardium Data Encryption (GDE) 3.0.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by…IBM · Security Guardium Data Encryption · CVSS 3.7 · 2020-08-26 | 3.7 | 0.6% | 2020-08-26 |
| CVE-2024-21872Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity CheckingElectrolink · Compact DAB Transmitter · CVSS 7.5 · 2024-04-18 | 7.5 | 0.6% | 2024-04-18 |
| CVE-2024-22186Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity CheckingElectrolink · Compact DAB Transmitter · CVSS 8.8 · 2024-04-18 | 8.8 | 0.5% | 2024-04-18 |
| CVE-2022-50926WAGO 750-8212 PFC200 G2 2ETH RS Privilege EscalationWago · WAGO 750-8212 PFC200 · CVSS 9.8 · 2026-01-13 | 9.8 | 0.5% | 2026-01-13 |
| CVE-2022-30620Cellinx NVT – IP PTZ Camera Privilege EscalationCellinx · Cellinx NVT - IP PTZ Camera · CVSS 8.2 · 2022-07-18 | 8.2 | 0.5% | 2022-07-18 |
| CVE-2026-75757AshAdmin cookie reader matches names by substring, enabling actor/session shadowing from a sibling subdomainash-project · ash_admin · CVSS 8.3 · 2026-08-31 | 8.3 | 0.5% | 2026-08-31 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.