Hubzero Cms Through 2.2.32 Session Fixation Via Query String Session Identifier

Back www.vulncheck.com

Hubzero Cms Through 2.2.32 Session Fixation Via Query String Session Identifier

www.vulncheck.com • September 18, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed for HUBzero and RosarioSIS CMS Vulnerabilities On September 17, 2026, four critical vulnerabilities were published affecting HUBzero CMS and RosarioSIS. CVE-2026-92984 allows session fixation attacks, enabling unauthenticated attackers to hijack user sessions. CVE-2026-92970 exposes a path traversal vulnerability that could lead to unauthorized file creation and potential code execution by authenticated users. CVE-2026-93014 in RosarioSIS permits authenticated users to delete files via path traversal, risking data integrity. Lastly, CVE-2026-92980 in HortusFox-Web allows remote code execution by authenticated administrators through the Import/Export functionality. All vulnerabilities are classified as high priority for remediation due to their potential impact on sensitive data and system integrity. Current exploitation status remains unconfirmed for all CVEs, but they require immediate attention from affected organizations. 4 sources 65

Extracted Entities

Vulnerabilities (1)

Session Fixation Via Query String Session Identifier