Lkw199711
Monthly
Auth bypass in Smanga 3.2.7 allows unauthenticated password reset for any user including admin.
RCE in Smanga 3.2.7 via command injection in /php/path/rescan.php. EPSS 0.29%.
smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Auth bypass in Smanga 3.2.7 allows unauthenticated password reset for any user including admin.
RCE in Smanga 3.2.7 via command injection in /php/path/rescan.php. EPSS 0.29%.
smanga 3.2.7 does not filter the file parameter at the PHP/get file flow.php interface, resulting in a path traversal vulnerability that can cause arbitrary file reading. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.