Smanga vulnerabilities

2 known vulnerabilities in Smanga from Lkw199711. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.4 Critical severity

  Smanga: Improper Authentication

  CVE-2025-70833Feb 20, 2026Lkw199711

  An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission v

• 9.8 Critical severity

  Smanga: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-70831Feb 20, 2026Lkw199711EPSS 1.04%

  A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unaut