Is CVE-2025-71455 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-71455 being exploited in the wild.

How severe is CVE-2025-71455?

Medium severity, with a CVSS score of 5.3, published 4 November 2026.

Is there a fix for CVE-2025-71455?

Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-71455 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-71455?

Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-71455: vtenext session identifier disclosure in Touch web service

CVE-2025-71455 · Severity: medium · CVSS 5.3 · Published 2026-11-04

vtenext is a CRM platform used by businesses to manage customer interactions and automate workflows. The vulnerability allows attackers who can inject scripts into the application—such as through cross-site scripting—to read PHP session identifiers that are supposed to be protected. An attacker exploiting this could hijack authenticated user sessions and gain unauthorized access to the system.

Technologies: Vtenext. Vendors: Vtenext.

Quick answers

Is CVE-2025-71455 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-71455 being exploited in the wild.
How severe is CVE-2025-71455?: Medium severity, with a CVSS score of 5.3, published 4 November 2026.
Which products and versions are affected?: Vtenext before 25.02.2.
Is there a fix for CVE-2025-71455?: Yes: fixed in vtenext 25.02.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-71455 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-71455?: Check whether you run Vtenext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: vtenext 25.02.2

Technical details

The Touch web service endpoint in vtenext before 25.02.2 discloses the PHPSESSID value in a way that bypasses the HttpOnly flag protection. An attacker with the ability to execute JavaScript in the vtenext origin (via XSS or similar) can read this session token and use it to impersonate authenticated users. This is a post-XSS session hijacking vulnerability requiring a preceding script-injection vulnerability.

Affected products

vtenext vtenext before 25.02.2

Timeline

2025-08-12: disclosed
2025-07-24: patched: Version 25.02.1 silently patched one authentication bypass vector
2025-08: patched: Version 25.02.2 patched remaining vulnerabilities
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.