CVE-2025-15578

9.8 criticalEPSS 0.3%

Critical (9.8) in teejay maypole. EPSS 0.3% chance of exploitation in the next 30 days.

Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-338
Published: 2026-02-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

teejay:maypole

References

https://metacpan.org/dist/Maypole/source/lib/Maypole/Session.pm#L43

Check your stack JSON