Skip to content
OpenAdvisories

Weakness (CWE)

CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag

Variant Incomplete

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

How to prevent it (1 mitigation)

  1. Implementation

    Leverage the HttpOnly flag when setting a sensitive cookie in a response.

Source: MITRE CWE-1004

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-39338 Public exploit

    ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prio…

    ChurchCRM CRM