Threats tagged 'ghsa-hxp8-52j7-5275'

A vulnerability in Oray Pugongying X5 Pro up to version 7.6.1 affects the session_get function in session.lua, related to the Session ID Handler. The flaw involves insufficient randomness in the _user argument, which can be exploited remotely. The attack complexity is high and exploitability is difficult. Public exploit code exists, but no vendor response or patch is available. The CVSS score rates this as a low-severity issue with limited impact on confidentiality and no impact on integrity or availability.