CVE-2025-70810

HighCVSS 8.8/10Last modified Nov 4, 2026

Description

Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the login function and the authentication mechanism

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/ariefibis/80e306765c23d6fac1584dbb76822e30Exploit, Third Party Advisory
https://github.com/ariefibisNot Applicable
https://www.linkedin.com/in/mohammed-a-6a2548112/Not Applicable
https://gist.github.com/ariefibis/80e306765c23d6fac1584dbb76822e30Exploit, Third Party Advisory

Timeline

Published: Apr 9, 2026
Last modified: Nov 4, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-708114.3Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via the Admin Control Pan CVE-2025-708196.3Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../CVE-2025-70828.8A vulnerability was found in Belkin F9K1122 1.00.33 and classified as critical. Affected by this issue is the function formBSSetSitesurvey o CVE-2025-708203.5Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.CVE-2025-708219.8renren-secuity before v5.5.0 is vulnerable to SQL Injection in the BaseServiceImpl.java component CVE-2025-708288.8An issue in Datart v1.0.0-rc.3 allows attackers to execute arbitrary code via the url parameter in the JDBC configuration CVE-2025-708295.7An information exposure vulnerability in Datart v1.0.0-rc.3 allows authenticated attackers to access sensitive data via a custom H2 JDBC con CVE-2025-70838.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been classified as critical. This affects the function mp of the file /goform/mp CVE-2025-708309.9A Server-Side Template Injection (SSTI) vulnerability in the Freemarker template engine of Datart v1.0.0-rc.3 allows authenticated attackers CVE-2025-708319.8A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface. The application fails to proper CVE-2025-708339.4An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the a CVE-2025-70848.8A vulnerability was found in Belkin F9K1122 1.00.33. It has been declared as critical. This vulnerability affects the function formWpsStart