ZeroDay Findings
Sign inSign up

Findings

CVE-2025-70833

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully tak…

Published Feb 20, 2026 · updated Jun 17, 2026 · lkw199711 smanga

An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 20, 2026 · NIST NVD

    Detected

    An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

  2. Jun 17, 2026 · NIST NVD

    Updated

    An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.

Affected

  • cpe lkw199711/smanga3.2.7

Sources

  • CVE.orgVulnerability recordCVE-2025-70833

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2025-70833

    An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-p

    nvd.nist.gov

References