Live › vulnerability › CVE-2026-120223
The session handler in Oray Pugongying X5 Pro up to 7.6.1 generates session values that are not random enough, so they can be predicted. An attacker who predicts a valid session value may be able to take over an existing login session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Organizations running Oray Pugongying X5 Pro up to version 7.6.1 are exposed through its session handling in session.lua. The sources do not say which deployments expose the session function to the internet or what configuration is needed. The vendor did not respond to disclosure, so no fixed version is stated.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-120223")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.