Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

Mstfakts College Management System lets attackers hijack sessions

CVE-2026-95828 · published 27 days ago
Summary

The login part of the Mstfakts College Management System can be tricked into keeping a user’s existing session ID, allowing an attacker who knows that ID to take over the user’s account from anywhere on the internet. This could let a malicious person see confidential student or staff information and perform actions as that user. Update the system as soon as a fix is released or ask the vendor to modify the code so a new session ID is created each time a user logs in, and limit remote access to the authentication page until it is patched.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mstfakts college-management-system 82ab01d057d96c8893c419cd9cb6870120faaea3
Original advisory text
Mstfakts College-Management-System Authentication server.php session_start session fixiation
A vulnerability was determined in Mstfakts College-Management-System. This affects the function session_start of the file Front-end/server.php of the component Authentication. Executing a manipulation can lead to session fixiation. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.1 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-384Session Fixation
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-95828 · NVD
CVE-2026-95828 · MITRE
CVE-2026-95828 · OSV
Track software like this
Free during beta