Skip to content

Instantly share code, notes, and snippets.

@ZeroBreach-GmbH

ZeroBreach-GmbH/CVE-2025-65415.MD

Last active May 5, 2026 15:15
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ZeroBreach-GmbH/459cad8e01fe99c6998bea556ac0dcb8 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ZeroBreach-GmbH/459cad8e01fe99c6998bea556ac0dcb8 to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2025-65415
Raw
CVE-2025-65415.MD
Description

The application is vulnerable to session fixation because it does not generate a new session identifier after successful authentication. An attacker may preset a session ID and induce a victim to authenticate with it.

Details
  • Product: docuForm FSM Client
  • Affected Versions: 11.11c
  • Vulnerability Type: CWE-384: Session Fixation
  • Risk Level: Medium - CVSS 3.1: 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
  • Vendor URL: www.docuform.de
  • Vendor acknowledged vulnerability: Yes
  • CVE: CVE-2025-65415
Impact

Successful exploitation may allow an attacker to hijack a victim’s authenticated session, resulting in access to the application.

References
Timeline
  • 2025-10: Vulnerability reported to the vendor.
  • 2025-11: Vendor published a fix for the issue.
  • 2026-04: Information about the vulnerability is published.
Credits
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment