PT-2025-48184 · Hastech · Hashtech

Published 2025-11-26 · Updated 2025-12-30 · CVE-2025-65276

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashTech versions 1.0 through commit 5919decaff2681dc250e934814fc3a35f6093ee5

Description A missing authentication check on the /admin index.php endpoint allows an attacker to access the administrative dashboard without valid credentials. This grants full administrative control, including the ability to view and modify user accounts, manage orders, change payments, and edit product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.

Recommendations Update HashTech to a version beyond commit 5919decaff2681dc250e934814fc3a35f6093ee5.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-65276

Affected Products

Hashtech

References · 8

• 🔥 https://gist.github.com/whoisrushi/c3bfcd1adf96d80952edbd03d0310836 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65276 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65276 · Security Note
• https://github.com/henzljw/hashtech · Note
• https://twitter.com/CVEnew/status/1993769466606534756 · Twitter Post
• https://t.me/cveNotify/147146 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1993806411835298072 · Twitter Post
• https://t.me/CVEtracker/38321 · Telegram Post