CWE-1004 · 33 records

Sensitive Cookie Without 'HttpOnly' Flag

CVEs in this class

33 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2025-26844No exploit	An issue was discovered in Znuny through 7.1.3.znuny · znuny · CWE-1004 Pre-auth	Critical9.8	—	0.4%	May 8, 2025
36Monitor	CVE-2021-42115No exploit	Missing HTTPOnly flag on sensitive cookie in TopEasebusinessdnasolutions · topease · CWE-1004 Pre-auth	Critical9.1	—	1.2%	Nov 30, 2021
36Monitor	CVE-2025-47289No exploit	Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flagphoenixcart · ce phoenix cart · CWE-1004 XSS	Critical9.0	—	0.2%	Jun 2, 2025
35Monitor	CVE-2026-22081No exploit	Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routerstenda · 300mbps wireless router f3 and n300 easy setup router · CWE-1004 Pre-auth	High8.8	—	0.3%	Jan 9, 2026
32Monitor	CVE-2026-42239No exploit	Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeoverbudibase · budibase · CWE-1004 XSS	High8.1	—	0.3%	May 7, 2026
32Monitor	GHSA-f777-f784-36gmNo exploit	TYPO3 Security Misconfiguration in Install Tool CookiePackagist · typo3/cms · CWE-1004 XSS	High8.1	—	—	Jun 7, 2024
31Monitor	CVE-2025-27223Proof of concept	TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPorrocketsoftware · trufusion enterprise · CWE-1004 Pre-auth	High7.5	—	2.2%	Oct 27, 2025
30Monitor	CVE-2021-3706No exploit	Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminltepi-hole · web interface · CWE-1004 Pre-auth	High7.5	—	1.1%	Sep 15, 2021
30Monitor	CVE-2022-33167No exploit	IBM Security Directory Integrator information disclosureibm · security directory integrator · CWE-1004 Pre-auth	High7.5	—	0.4%	Jul 30, 2024
30Monitor	CVE-2022-43845No exploit	IBM Aspera Console information disclosureibm · aspera console · CWE-1004 Pre-auth	High7.5	—	0.4%	Sep 24, 2024
30Monitor	GHSA-ppvg-hw62-6ph9No exploit	TYPO3 Security Misconfiguration in Install Tool CookiePackagist · typo3/cms-core · CWE-1004 Pre-auth XSS	High7.5	—	—	May 30, 2024
29Monitor	CVE-2026-53660No exploit	OpenAM Insecure SSO Cookie Initializationopenidentityplatform · openam · CWE-1004 Pre-auth XSS CSRF	High7.4	—	0.4%	Sep 15, 2026
27Monitor	CVE-2024-41685No exploit	Cookie Without HTTPOnly Flag Set Vulnerabilitysyrotech · sy-gpon-1110-wdont firmware · CWE-1004 Pre-auth	Medium6.9	—	0.4%	Jul 26, 2024
26Monitor	CVE-2019-8283No exploit	Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag.gemalto · sentinel ldk · CWE-1004 Pre-auth	Medium6.5	—	1.1%	Jun 7, 2019
26Monitor	CVE-2021-39210No exploit	Autologin cookie accessible by scriptsglpi-project · glpi · CWE-1004	Medium6.5	—	1.0%	Sep 15, 2021
26Monitor	CVE-2025-27453No exploit	The HttpOnly flag is set to false on the PHPSESSION cookie.endress · meac300-fnade4 firmware · CWE-1004 Pre-auth	Medium6.5	—	0.4%	Jul 3, 2025
26Monitor	CVE-2026-0696No exploit	Session Cookies Missing HttpOnly Attributeconnectwise · professional service automation · CWE-1004 Pre-auth	Medium6.5	—	0.3%	Jan 16, 2026
24Monitor	CVE-2020-27658No exploit	Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makesynology · router manager · CWE-1004 Pre-auth	Medium6.1	—	1.3%	Oct 29, 2020
24Monitor	CVE-2022-25172No exploit	An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4.inhandnetworks · ir302 firmware · CWE-1004 Pre-auth XSS	Medium6.1	—	1.0%	May 12, 2022
24Monitor	CVE-2022-21939No exploit	Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)johnsoncontrols · metasys system configuration tool · CWE-1004 Pre-auth	Medium6.1	—	0.5%	Feb 9, 2023
24Monitor	CVE-2024-6739No exploit	Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flagopenfind · mailaudit · CWE-1004 Pre-auth XSS	Medium6.1	—	0.4%	Jul 15, 2024
24Monitor	CVE-2025-49189No exploit	Cookie missing HttpOnly flagsick · media server · CWE-1004 Pre-auth	Medium6.1	—	0.2%	Jun 12, 2025
24Monitor	CVE-2023-2876No exploit	Session cookie exposure for client side scriptabb · rex640 pcl1 firmware · CWE-1004 Pre-auth XSS	Medium6.1	—	0.2%	Jun 13, 2023
23Monitor	CVE-2025-24318No exploit	Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flagdario health · dario application database and internet-based server infrastructure · CWE-1004 Pre-auth XSS	Medium5.9	—	0.3%	Feb 28, 2025
21Monitor	CVE-2020-6267No exploit	Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only sap · disclosure management · CWE-1004 Pre-auth	Medium5.4	—	0.7%	Jul 14, 2020

CVE-2025-26844
39Monitor
An issue was discovered in Znuny through 7.1.3.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
znuny · znunyMay 8, 2025
CVE-2021-42115
36Monitor
Missing HTTPOnly flag on sensitive cookie in TopEase
CriticalCVSS 9.1No exploitEPSS 1%
- Pre-auth
businessdnasolutions · topeaseNov 30, 2021
CVE-2025-47289
36Monitor
Stored XSS in CE Phoenix Cart Testimonials Allows Account Takeover if Missing HttpOnly Flag
CriticalCVSS 9.0No exploitEPSS 0%
- XSS
phoenixcart · ce phoenix cartJun 2, 2025
CVE-2026-22081
35Monitor
Cookie without HTTPOnly Flag Vulnerability in Tenda Wireless Routers
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
tenda · 300mbps wireless router f3 and n300 easy setup routerJan 9, 2026
CVE-2026-42239
32Monitor
Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeover
HighCVSS 8.1No exploitEPSS 0%
- XSS
budibase · budibaseMay 7, 2026
GHSA-f777-f784-36gm
32Monitor
TYPO3 Security Misconfiguration in Install Tool Cookie
HighCVSS 8.1No exploit
- XSS
Packagist · typo3/cmsJun 7, 2024
CVE-2025-27223
31Monitor
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPor
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
rocketsoftware · trufusion enterpriseOct 27, 2025
CVE-2021-3706
30Monitor
Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
pi-hole · web interfaceSep 15, 2021
CVE-2022-33167
30Monitor
IBM Security Directory Integrator information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · security directory integratorJul 30, 2024
CVE-2022-43845
30Monitor
IBM Aspera Console information disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
ibm · aspera consoleSep 24, 2024
GHSA-ppvg-hw62-6ph9
30Monitor
TYPO3 Security Misconfiguration in Install Tool Cookie
HighCVSS 7.5No exploit
- Pre-auth
- XSS
Packagist · typo3/cms-coreMay 30, 2024
CVE-2026-53660
29Monitor
OpenAM Insecure SSO Cookie Initialization
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
openidentityplatform · openamSep 15, 2026
CVE-2024-41685
27Monitor
Cookie Without HTTPOnly Flag Set Vulnerability
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
syrotech · sy-gpon-1110-wdont firmwareJul 26, 2024
CVE-2019-8283
26Monitor
Hasplm cookie in Gemalto Admin Control Center, all versions prior to 7.92, does not have 'HttpOnly' flag.
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
gemalto · sentinel ldkJun 7, 2019
CVE-2021-39210
26Monitor
Autologin cookie accessible by scripts
MediumCVSS 6.5No exploitEPSS 1%
glpi-project · glpiSep 15, 2021
CVE-2025-27453
26Monitor
The HttpOnly flag is set to false on the PHPSESSION cookie.
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
endress · meac300-fnade4 firmwareJul 3, 2025
CVE-2026-0696
26Monitor
Session Cookies Missing HttpOnly Attribute
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
connectwise · professional service automationJan 16, 2026
CVE-2020-27658
24Monitor
Synology Router Manager (SRM) before 1.2.4-8081 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which make
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
synology · router managerOct 29, 2020
CVE-2022-25172
24Monitor
An information disclosure vulnerability exists in the web interface session cookie functionality of InHand Networks InRouter302 V3.5.4.
MediumCVSS 6.1No exploitEPSS 1%
- Pre-auth
- XSS
inhandnetworks · ir302 firmwareMay 12, 2022
CVE-2022-21939
24Monitor
Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
johnsoncontrols · metasys system configuration toolFeb 9, 2023
CVE-2024-6739
24Monitor
Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
openfind · mailauditJul 15, 2024
CVE-2025-49189
24Monitor
Cookie missing HttpOnly flag
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
sick · media serverJun 12, 2025
CVE-2023-2876
24Monitor
Session cookie exposure for client side script
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
abb · rex640 pcl1 firmwareJun 13, 2023
CVE-2025-24318
23Monitor
Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Sensitive Cookie Without 'HttpOnly' Flag
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- XSS
dario health · dario application database and internet-based server infrastructureFeb 28, 2025
CVE-2020-6267
21Monitor
Some sensitive cookies in SAP Disclosure Management, version 10.1, are missing HttpOnly flag, leading to sensitive cookie without Http Only
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
sap · disclosure managementJul 14, 2020

All vulnerability classes