CVE-2025-7015: Session Fixation in Akinsoft QR Menu Before s1.05.12

CVE-2025-7015 is a medium severity session fixation flaw (CVSS 5.7) in Akin Software QR Menu, versions before s1.05.12. An attacker can set a session identifier that the victim then keeps using. Update to s1.05.12 or later and end active sessions afterwards.

What's affected

• Akin Software (Akinsoft) QR Menu before s1.05.12.
• Fixed version: s1.05.12, based on the affected range in the record. Confirm in the national CERT notice.

How to check if you're exposed

Read the QR Menu version in the application or from your vendor's update records. Anything before s1.05.12 is in scope.

This CVE and CVE-2025-7016 share one notice, TR-26-0006, so check both together.

What to do now

1. Check the QR Menu version.
2. Update to s1.05.12 or later.
3. After the update, end all active sessions so every user logs in again.
4. Review the notice TR-26-0006 for any further steps.
5. Make sure the site is served over HTTPS only.

A simple test after the update is to log in from a clean browser and confirm that the session identifier changes between the pre login and post login pages. If it stays the same, tell the vendor. Short session lifetimes and logout on password change also limit the value of a fixed session.

Why it matters

The weakness is CWE-384, session fixation. Normally the server creates a new session identifier when someone logs in. If it keeps an identifier that was set earlier, an attacker who planted that value can use the session once the victim signs in.

The vector needs a logged in privileged user and user interaction, which is why the score is moderate. The usual remedy is to issue a fresh identifier at login, and that is a change in the application. The record does not list this CVE as exploited in the wild.

Quick check

Sources

• https://www.usom.gov.tr/bildirim/tr-26-0006
• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0006

Last reviewed: 19 October 2026.