session-hijacking 1 Incident Response Report: RetailBreach — Stored XSS, Session Hijacking & Path Traversal on ShopSphere Mar 22, 2026