CVE-2025-6967 is an Execution After Redirect (EAR) vulnerability classified under CWE-698 affecting the CMS product from Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. It enables JSON Hijacking (JavaScript Hijacking) and authentication bypass, which can compromise confidentiality and integrity of the system. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and scope changed. The vendor has not provided any response or patch, and the affected versions include all versions through 10022026.

Successful exploitation of this vulnerability can lead to unauthorized access by bypassing authentication mechanisms and theft or manipulation of sensitive JSON data via hijacking techniques. The confidentiality and integrity of the CMS system are highly impacted. Availability impact is not indicated. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the CMS system to trusted networks and users to reduce exposure.