Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Food-waste-management-system login page allows session hijacking

CVE-2026-105233 · published 14 days ago
Summary

The login.php file in the Food-waste-management-system can be tricked into using a attacker-chosen session ID. This lets a remote user take over a victim's session after they log in. Update the login code to generate a new, secure session ID and reject any supplied PHPSESSID values.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93
Original advisory text
kishor-23 food-waste-management-system Login Flow login.php session fixiation
A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file login.php of the component Login Flow. Such manipulation of the argument PHPSESSID leads to session fixiation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published5 Oct 2026
Updated15 Oct 2026
First seen5 Oct 2026
Sources
CVE-2026-105233 · NVD
CVE-2026-105233 · MITRE
CVE-2026-105233 · OSV
Track software like this
Free during beta