Is CVE-2025-7015 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-7015 being exploited in the wild.

How severe is CVE-2025-7015?

Medium severity, with a CVSS score of 5.7, published 29 January 2026.

Which products and versions are affected?

Akın Software Computer Import Export Industry and Trade Ltd. QR Menu before s1.05.12.

Is there a fix for CVE-2025-7015?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-7015 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-7015?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-7015: Akın Software QR Menu session fixation

CVE-2025-7015 · Severity: medium · CVSS 5.7 · Published 2026-01-29

Akın Software's QR Menu, a digital menu platform for restaurants and businesses, contains a security flaw that could allow an attacker to hijack a user's session. By tricking a user into using a pre-determined session identifier, an attacker can gain unauthorized access to the user's account or sensitive information. This could lead to the exposure of customer data or unauthorized changes to menu configurations.

Quick answers

Is CVE-2025-7015 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-7015 being exploited in the wild.
How severe is CVE-2025-7015?: Medium severity, with a CVSS score of 5.7, published 29 January 2026.
Which products and versions are affected?: Akın Software Computer Import Export Industry and Trade Ltd. QR Menu before s1.05.12.
Is there a fix for CVE-2025-7015?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-7015 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-7015?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A session fixation vulnerability (CWE-384) exists in Akın Software QR Menu versions prior to s1.05.12. The application fails to invalidate existing session identifiers or issue new ones upon user authentication, allowing an attacker to fixate a victim's session ID. An attacker can exploit this by providing a known session ID to a victim (typically requiring some user interaction) and then hijacking the session once the victim authenticates. This vulnerability is reachable over the network and requires low privileges to initiate, potentially leading to a loss of confidentiality. The issue is addressed in version s1.05.12.

Affected products

Akın Software Computer Import Export Industry and Trade Ltd. QR Menu before s1.05.12

Timeline

2026-01-29: disclosed: Initial publication of the CVE record.
2026-01-29: advisory: Advisory published by USOM (TR-CERT).
2026-03-09: other: NVD enrichment and CPE configuration added.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.