CVE-2025-70758
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-70758 is a high-severity Improper Check or Handling of Exceptional Conditions (CWE-703) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-24 (Fail in Known State) and SI-17 (Fail-safe Procedures) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-70758 is an authentication bypass vulnerability in the chetans9 core-php-admin-panel project through commit a94a780d6. The flaw exists in the includes/auth_validate.php component, where the application issues an HTTP redirect header (Location: login.php) upon detecting an unauthenticated user but neglects to invoke exit() afterward. This CWE-703 improper check or handling of exceptional conditions allows the script to continue execution, exposing protected resources. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
Remote unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. By directly accessing protected endpoints, attackers bypass the authentication check, as the redirect header is sent but the response body—including sensitive data from protected pages and the customer database—continues to be served before the browser follows the redirect.
References for CVE-2025-70758 include a vulnerability research repository at https://github.com/XavLimSG/Vulnerability-Research/tree/main/CVE-2025-70758, the affected core-php-admin-panel project at https://github.com/chetans9/core-php-admin-panel, and the specific vulnerable file at https://github.com/chetans9/core-php-admin-panel/blob/master/includes/auth_validate.php. No vendor advisories or patches are detailed in the provided information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206699
Vulnerability Data
chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php. The application sends an HTTP redirect via header(Location:login.php) when a user is not authenticated but fails to call exit() afterward. This allows remote unauthenticated attackers to access protected…
more
pages.customer database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces failure to a known state while preserving required properties, limiting impact of unhandled exceptions.
Mandates explicit fail-safe procedures triggered by indicated failures, structurally preventing unhandled exceptional conditions.
Requires application of security engineering principles that include robust exception and error handling during design.
Requires generation of safe, actionable error messages that directly addresses proper handling of exceptional conditions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require anticipating and correctly handling exceptional conditions during design and coding.