CVE-2025-15578
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
16 Feb 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
TEEJAY · MaypoleWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →