CVE-2016-2304

CVE-2016-2304 describes a vulnerability in Ecava IntegraXor versions prior to 5.0 build 4522, where the session cookie lacks the HTTPOnly flag. This omission allows remote attackers to access potentially sensitive session information through client-side scripts. Rated as Medium severity (CVSS 4.3), the vulnerability requires user interaction (UI:R) but has low impact on confidentiality (C:L). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received some community discussion and media coverage.