An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.
References
| Link | Resource |
|---|---|
| https://gist.github.com/whoisrushi/c3bfcd1adf96d80952edbd03d0310836 | Third Party Advisory |
| https://gist.github.com/whoisrushi/c3bfcd1adf96d80952edbd03d0310836 | Third Party Advisory |
Configurations
History
30 Dec 2025, 15:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/whoisrushi/c3bfcd1adf96d80952edbd03d0310836 - Third Party Advisory | |
| CPE | cpe:2.3:a:henzljw:hashtech:*:*:*:*:*:*:*:* | |
| First Time |
Henzljw
Henzljw hashtech |
01 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/whoisrushi/c3bfcd1adf96d80952edbd03d0310836 - | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-284 |
26 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-26 20:15
Updated : 2025-12-30 15:34
NVD link : CVE-2025-65276
Mitre link : CVE-2025-65276
CVE.ORG link : CVE-2025-65276
JSON object : View
Products Affected
henzljw
- hashtech
CWE
CWE-284
Improper Access Control