Language: PHP
Label: vulnerable
CWE: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Code:
    public static function setCookie($key, $value, $time = 3600, $path = '/', $http_only = true, $domain = '') {

        $cookie_domain = cmsConfig::get('cookie_domain');

        if (!$domain && $cookie_domain) {
            $domain = $cookie_domain;
        }

        if (PHP_VERSION_ID < 70300) {
            return setcookie('icms[' . $key . ']', $value, time() + $time, $path, $domain, false, $http_only);
        } else {
            return setcookie('icms[' . $key . ']', $value, [
                'expires'  => time() + $time,
                'path'     => $path,
                'domain'   => $domain,
                'samesite' => 'Lax',
                'secure'   => false,
                'httponly' => $http_only
            ]);
        }
    }