CVE Intelligence

Lkw199711 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Lkw199711 products: 2 record(s), with severity, exploitation and fixes.

Smanga 2

Exploited only (KEV) →

CVE-2025-70833 Critical · 9.4 CWE-287 Feb 20, 2026
Improper Authentication in Lkw199711 Smanga
An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and fully takeover the account by manipulating POST parameters. The issue stems from insecure permission validation in check-power.php.
CVE-2025-70831 Critical · 9.8 CWE-78 Feb 20, 2026
OS Command Injection in Lkw199711 Smanga
A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to properly sanitize user-supplied input in the mediaId parameter before using it in a system shell command. This allows an unauthenticated attacker to inject arbitrary operating system commands, leading to complete server compromise.