CVE-2025-6967
High · 8.7CVSS
8.7
EPSS
0.5%
Published
Feb 10, 2026
CISA due date
—
The record
Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-61407 Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with… CWE-698
- CVE-2026-10271 A flaw has been found in a4m4 Student-Management-System up to… CWE-698
- CVE-2026-2699 Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated… CWE-698
- CVE-2026-3264 A vulnerability was determined in go2ismail Free-CRM up to… CWE-698
- CVE-2026-3262 A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-Syste… CWE-698
- CVE-2025-8350 Execution After Redirect (EAR), Missing Authentication for Critical Function… CWE-698