可获取的关键信息 CVE ID: CVE-2025-70758 Priority: - CVSS: 9.1 (Critical) - CWE: CWE-287 (Improper Authentication) Affected: All versions before commit 76f631d Fixed: Commit 76f631d (PR #44) Description Missing after redirect in allows unauthenticated attackers to bypass authentication and access protected pages including customer data. Vulnerable Code PoC Python Exploit Impact Unauthenticated access to customer database PII exposure (names, emails, addresses) CSV export of entire database via Fix Update to latest version: Add after the redirect: References Repository: https://github.com/chetans9/core-php-admin-panel Fix PR: https://github.com/chetans9/core-php-admin-panel/pull/44 Disclosure: https://github.com/chetans9/core-php-admin-panel/issues/43 Timeline 2025-12-29: Discovered and reported 2026-01-31: Fixed in PR #44 2026-01-31: CVE assigned Credit Discovered by: Xavier Lim (XavLimSG on GitHub)