CWE-565 · Reliance on Cookies without Validation and Integrity Checking
75 CVEs classified under CWE-565 (Reliance on Cookies without Validation and Integrity Checking). Browse by severity and year.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45128 | Critical | 10.0 | 2023-10-16 | Fiber is an express inspired web framework written in Go. A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the application, which allow… |
CVE-2023-41084 | Critical | 10.0 | 2023-09-18 | Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the… |
CVE-2026-39324 | Critical | 9.8 | 2026-04-07 | Rack::Session is a session management implementation for Rack. From 2.0.0 to before 2.1.2, Rack::Session::Cookie incorrectly handles decryption failures when c… |
CVE-2014-125112 | Critical | 9.8 | 2026-03-26 | Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a… |
CVE-2022-50926 | Critical | 9.8 | 2026-01-13 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can… |
CVE-2025-65212 | Critical | 9.8 | 2026-01-06 | An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification… |
CVE-2025-14440 | Critical | 9.8 | 2025-12-13 | The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authent… |
CVE-2025-2395 | Critical | 9.8 | 2025-03-17 | The U-Office Force from e-Excellence has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to use a particular API and alter… |
CVE-2024-0947 | Critical | 9.8 | 2024-06-27 | Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Man… |
CVE-2024-28288 | Critical | 9.8 | 2024-03-30 | Ruijie RG-NBR700GW 10.3(4b12) router lacks cookie verification when resetting the password, resulting in an administrator password reset vulnerability. An atta… |
CVE-2023-35885 | Critical | 9.8 | 2023-06-20 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. |
CVE-2023-3050 | Critical | 9.8 | 2023-06-13 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allows Privilege Abuse, Authentication Bypas… |
CVE-2022-38297 | Critical | 9.8 | 2022-09-12 | UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning. |
CVE-2021-28171 | Critical | 9.8 | 2021-04-06 | The Vangene deltaFlow E-platform does not take properly protective measures. Attackers can obtain privileged permissions remotely by tampering with users’ data… |
CVE-2019-7266 | Critical | 9.8 | 2019-07-02 | Linear eMerge 50P/5000P devices allow Authentication Bypass. |
CVE-2018-20512 | Critical | 9.8 | 2019-01-03 | EPON CPE-WiFi devices 2.0.4-X000 are vulnerable to escalation of privileges by sending cooLogin=1, cooUser=admin, and timestamp=-1 cookies. |
CVE-2018-5190 | Critical | 9.8 | 2018-04-17 | PicturesPro Photo Cart 6 and 7 before Security-Patch-2018-B allows remote attackers to access arbitrary customer accounts via a modified cookie, related to pc_… |
CVE-2018-5455 | Critical | 9.8 | 2018-03-05 | A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series version 1.4 Build 16062919 and prior. The… |
CVE-2017-7279 | Critical | 9.8 | 2017-04-12 | An unprivileged user of the Unitrends Enterprise Backup before 9.0.0 web server can escalate to root privileges by modifying the "token" cookie issued at login. |
CVE-2008-5784 | Critical | 9.8 | 2008-12-31 | V3 Chat - Profiles/Dating Script 3.0.2 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1. |