p PatchFirst

CVE-2025-26844

CVE-2025-26844

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.

CVSS 9.8 · Critical · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • znuny Debian:12

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1
    • 6.4.5-1~bpo11+1
    • 6.4.5-2
    • 6.5.1-1
    • 6.5.10-1
    • 6.5.10-1~bpo12+1
    • 6.5.11-1
    • 6.5.11-1~bpo12+1
    • 6.5.13-1
    • 6.5.14-1
    • 6.5.14-1~bpo12+1
    • 6.5.15-1
    • 6.5.15-2
    • 6.5.15-2~bpo12+1
    • 6.5.16-1
    • 6.5.18-1
    • 6.5.18-1~bpo13+1
    • 6.5.19-1
    • 6.5.20-1
    • 6.5.21-1
    • 6.5.22-1
    • 6.5.22-1~bpo13+1
    • 6.5.23-1
    • 6.5.23-1~bpo13+1
    • 6.5.24-1
    • 6.5.24-1~bpo13+1
    • 6.5.3-1
    • 6.5.3-1~bpo12+1
    • 6.5.4-1
    • 6.5.4-1~bpo12+1
    • 6.5.5-1
    • 6.5.5-1~bpo12+1
    • 6.5.6-1
    • 6.5.6-1~bpo12+1
    • 6.5.8-1
    • 6.5.8-1~bpo12+1
    • 6.5.9-1
    • 6.5.9-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • znuny Debian:13

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1
    • 6.4.5-1~bpo11+1
    • 6.4.5-2
    • 6.5.1-1
    • 6.5.10-1
    • 6.5.10-1~bpo12+1
    • 6.5.11-1
    • 6.5.11-1~bpo12+1
    • 6.5.3-1
    • 6.5.3-1~bpo12+1
    • 6.5.4-1
    • 6.5.4-1~bpo12+1
    • 6.5.5-1
    • 6.5.5-1~bpo12+1
    • 6.5.6-1
    • 6.5.6-1~bpo12+1
    • 6.5.8-1
    • 6.5.8-1~bpo12+1
    • 6.5.9-1
    • 6.5.9-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: < 6.5.13-1

    Update to 6.5.13-1

  • znuny Debian:14

    Versions
    • 6.3.2-3
    • 6.3.3-1
    • 6.3.3-1~bpo11+1
    • 6.3.4-1
    • 6.3.4-1~bpo11+1
    • 6.4.2-1
    • 6.4.2-1~bpo11+1
    • 6.4.2-2
    • 6.4.3-1
    • 6.4.3-1~bpo11+1
    • 6.4.4-1
    • 6.4.5-1
    • 6.4.5-1~bpo11+1
    • 6.4.5-2
    • 6.5.1-1
    • 6.5.10-1
    • 6.5.10-1~bpo12+1
    • 6.5.11-1
    • 6.5.11-1~bpo12+1
    • 6.5.3-1
    • 6.5.3-1~bpo12+1
    • 6.5.4-1
    • 6.5.4-1~bpo12+1
    • 6.5.5-1
    • 6.5.5-1~bpo12+1
    • 6.5.6-1
    • 6.5.6-1~bpo12+1
    • 6.5.8-1
    • 6.5.8-1~bpo12+1
    • 6.5.9-1
    • 6.5.9-1~bpo12+1
    Affected ranges
    • ECOSYSTEM: < 6.5.13-1

    Update to 6.5.13-1

  • znuny Ubuntu:24.04:LTS

    Versions
    • 6.5.3-1
    • 6.5.4-1
    • 6.5.5-1
    • 6.5.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →