CVE Intelligence
Analysis AI-assisted

CVE-2025-7015: Akinsoft QR Menu Session Fixation Vulnerability

CVE-2025-7015 is a session fixation weakness (CWE-384) in Akinsoft QR Menu, affecting versions before s1.05.12. NVD rates it critical at 9.8, while the CNA USOM rates it 5.7 under CVSS 3.1. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-7015 is a session fixation weakness (CWE-384) in QR Menu, a product of Akın Software Computer Import Export Industry and Trade Ltd. marketed as Akinsoft Qr Menu. The record states that the issue affects versions before s1.05.12. The CVE was published on 2026-01-29 and the record was later modified.

Impact

  • Session fixation weaknesses can allow a session identifier to be set or kept by an attacker, which may let an unauthorized party reuse an authenticated session.
  • NVD scored the issue 9.8 (critical) with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, while the CNA (USOM) scored it 5.7 under CVSS 3.1. The difference should be checked against the vendor and the advisory.
  • The actual impact depends on how the product issues and validates sessions, which the record does not describe.

Affected products and versions

  • Product: Akinsoft Qr Menu.
  • Affected range in the record: versions before s1.05.12.
  • The record does not list a fixed version. Confirm the exact patched build with the vendor.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.

Remediation and mitigation

  • Identify all QR Menu installations and their versions.
  • Update to a vendor-provided release later than s1.05.12, consistent with the version boundary in the record, and verify it with the vendor.
  • Until patched, limit exposure of administrative or customer-facing sessions where possible and monitor for unusual session activity.
  • Review the national advisories listed in the references.

Detection guidance

  • Review application logs for session identifiers used from multiple networks or devices.
  • Look for sessions that persist unusually after login or that appear before authentication.
  • Monitor account activity after unexpected session reuse.

Limitations of the available information

The record does not include vendor advisory text, a fixed version, EPSS, SSVC or detailed technical conditions. The CVSS discrepancy between NVD and the CNA is unresolved. Exact exploitation prerequisites are unknown.

Frequently asked questions

Is CVE-2025-7015 being actively exploited?

This record does not list the CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record states that QR Menu versions before s1.05.12 are affected. No fixed version is populated in the record, so confirm the patched build with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.