CVE-2025-70833

9.4 criticalEPSS 0.5%

Critical (9.4) in lkw199711 smanga. EPSS 0.5% chance of exploitation in the next 30 days.

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

Severity

CVSS 3.1

9.4 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWEs: CWE-287, CWE-639
Published: 2026-02-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lkw199711:smanga

References

https://github.com/LX-66-LX/cve/issues/4

Check your stack JSON