CVE-2025-49189: Sick Media Server

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The HttpOnlyflag of the session cookie \"@@\" is set to false. Since this flag helps preventing access to cookies via client-side scripts, setting the flag to false can lead to a higher possibility of Cross-Side-Scripting attacks which target the stored cookies.

Affected products

• Sick Media Server: before 1.5 (fixed in 1.5)

Published 2025-06-12. Last modified 2026-06-17.