CVE-2026-24352 — PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID — CVE Database · The Intelligence Room