CVE-2026-120223
Low · 3.1CVSS
3.1
EPSS
0.3%
Published
Nov 1, 2026
CISA due date
—
The record
A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.1. This impacts the function session_get of the file session.lua of the component Session ID Handler. The manipulation of the argument _user leads to insufficiently random values. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. CWE-310
- CVE-2026-115247 A security vulnerability has been detected in subhajitkhan… CWE-310
- CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. CWE-310
- CVE-2026-86280 A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management &… CWE-310
- CVE-2026-82699 A flaw has been found in sambitraj Student Management System up to… CWE-310
- CVE-2026-82555 A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. CWE-310
- CVE-2026-81836 A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. CWE-310
- CVE-2026-19896 A flaw has been found in mangroup dtale up to 3.22.0. CWE-310