CVE-2025-7015

Medium

Published: 29 January 2026

Published

29 January 2026

Modified

09 March 2026

KEV Added

—

Patch

—

CVSS Score 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

EPSS Score 0.0004 13.4th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7015 is a medium-severity Session Fixation (CWE-384) vulnerability in Akinsoft Qr Menu. Its CVSS base score is 5.7 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-12 Session Termination

addresses: CWE-384

Session termination after a set interval shortens the usable lifetime of a fixed session identifier, making successful exploitation of session fixation more difficult.

IA-11 Re-authentication

addresses: CWE-384

Re-authentication typically forces issuance of a new session, limiting the window for exploitation of a previously fixed session identifier.

SC-23 Session Authenticity

addresses: CWE-384

Enforces proper session ID generation and binding, preventing fixation of a known session token.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1550.004 Web Session Cookie Lateral Movement

Adversaries can use stolen session cookies to authenticate to web applications and services.

attack.mitre.org →

Why these techniques?

Session fixation in public-facing web app directly enables exploitation for initial access (T1190) and use of fixed session token as alternate auth material (T1550.004).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation.This issue affects QR Menu: before s1.05.12.

Deeper analysisAI

CVE-2025-7015 is a Session Fixation vulnerability (CWE-384) in the QR Menu software developed by Akın Software Computer Import Export Industry and Trade Ltd. The issue affects QR Menu versions prior to s1.05.12. It has a CVSS v3.1 base score of 5.7 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with network accessibility, low attack complexity, requirements for low-privilege authentication and user interaction, unchanged scope, and high impact on confidentiality.

An authenticated attacker with low privileges can exploit this vulnerability over the network by fixing a session identifier and tricking a user into authenticating with that fixed session. Upon successful user interaction, the attacker gains access to the victim's session, potentially exposing sensitive confidential information without impacting integrity or availability.

The Turkish National Cyber Incident Response Center (USOM) has issued an advisory on this vulnerability, available at https://www.usom.gov.tr/bildirim/tr-26-0006. Mitigation involves upgrading to QR Menu version s1.05.12 or later, where the issue is addressed.