Vulnerability · Published Feb 10, 2026 · Assigned by TR-CERT

CVE-2025-6967Authentication Bypass in Sarman Soft's CMS

High 8.7

In plain English

A high-severity security flaw in CMS from Sarman Soft Software and Technology Services Industry and Trade Ltd. Co.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.5%top 57.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScript Hijacking), Authentication Bypass. This issue affects CMS: through 10022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Sarman Soft Software and Technology Services Industry and Trade Ltd. Co.	CMS	0 – through 10022026

Weakness: CWE-698 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://www.usom.gov.tr/bildirim/tr-26-0050 government-resource, broken-link
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0050 government-resource