Read the docs
TI-2025-44011 Aliases CVE-2025-71455GHSA-rxq9-mwhc-2q96

vtenext Session Identifier Disclosure via Touch Web Service

Priority MEDIUM 60CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

vtenext before 25.02.2 lets attackers read the PHPSESSID value returned by the Touch web service endpoint, which is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. An attacker who can run script in the vtenext origin, for example through cross-site scripting, can read the session identifier despite the HttpOnly flag and hijack authenticated sessions. The CVSS 4.0 base score is 5.9 (MEDIUM). A proof-of-concept exploit exists, but CISA has not added the flaw to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed vtenext (vtenext): 25.02.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vtenextvtenextbefore 25.02.225.02.2Patch availableCNA
  • vtenext Vendorvtenext Affected before 25.02.2 Fixed in 25.02.2 Patch available CNA

Remediation

Upgrade vtenext to version 25.02.2 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA vtenext (vtenext) Fixed in 25.02.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    vtenext 25.02.2

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-44012 SQL injection in VTENext Fax EditView exposes database contentsPriority HIGH 72
    • TI-2025-44010 CSRF protection bypass in vtenext via non-POST requestsPriority MEDIUM 64
    • TI-2025-44009 Reflected XSS in VTENext HomeWidgetBlockList via widgetInfoListPriority LOW 23
    Show all 4 records →

Timeline

  1. 2026-11-04 Threatist record created from CVE-2025-71455
  2. 2026-11-04 Alias added: GHSA-rxq9-mwhc-2q96
  3. 2026-11-05 CISA SSVC decision points changed

References

Exploit 1

Other 2

  • TI-2025-44013 Authentication bypass in VTENext allows password changes CVSS 4.0CRITICAL 9.3
  • TI-2025-44012 SQL injection in VTENext Fax EditView exposes database contents CVSS 4.0HIGH 8.6
  • TI-2025-44010 CSRF protection bypass in vtenext via non-POST requests CVSS 4.0MEDIUM 6.9
  • TI-2020-08240 A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload… CVSS 3.1HIGH 8.8
  • TI-2020-08241 A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an… CVSS 3.1HIGH 8.8
  • TI-2020-08239 A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE… CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences