CVE-2025-7015
Published: 29 January 2026
Summary
CVE-2025-7015 is a medium-severity Session Fixation (CWE-384) vulnerability in Akinsoft Qr Menu. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-7015 is a Session Fixation vulnerability (CWE-384) in the QR Menu software developed by Akın Software Computer Import Export Industry and Trade Ltd. The issue affects QR Menu versions prior to s1.05.12. It has a CVSS v3.1 base score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with network accessibility, low attack complexity, requirements for low-privilege authentication and user interaction, unchanged scope, and high impact on confidentiality.
An authenticated attacker with low privileges can exploit this vulnerability over the network by fixing a session identifier and tricking a user into authenticating with that fixed session. Upon successful user interaction, the attacker gains access to the victim's session, potentially exposing sensitive confidential information without impacting integrity or availability.
The Turkish National Cyber Incident Response Center (USOM) has issued an advisory on this vulnerability, available at https://www.usom.gov.tr/bildirim/tr-26-0006. Mitigation involves upgrading to QR Menu version s1.05.12 or later, where the issue is addressed.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206548
Vulnerability details
Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: before s1.05.12.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Session fixation in public-facing web app directly enables exploitation for initial access (T1190) and use of fixed session token as alternate auth material (T1550.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires protection of session authenticity, which prevents an attacker from fixing a session identifier that a subsequent user authenticates to.
Enforces timely session termination and invalidation, limiting the window in which a fixed session ID remains usable after login.
Requires prompt remediation of known flaws, directly addressed by upgrading QR Menu to s1.05.12 or later where the session-fixation defect is corrected.