by Kastro
Paper/Archive/CVE-2025-70833

CVE-2025-70833

mitre — An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including th…

EPSS 0.5%public exploitCVSS 9.4
critical.is priorityof 100
46
CVSS 9.4 (ADP)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 40.1.401 × 208.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial

References

refgithub.com/LX-66-LX/cve/issues/4