CVE-2026-25803

CRITICAL 9.8CVE-2026-25803 · Published 06/02/2026 · updated 17/06/2026

In short

CVE-2026-25803 is a CRITICAL (CVSS 9.8) vulnerability affecting 3dp-manager (denpiligrim).
Chance of exploitation in the next 30 days (EPSS): 0.40%, higher than 34.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
3dp-manager denpiligrim	`≤ 2.0.1`	No fix yet

Description

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an administrative account with known default credentials (admin/admin) upon the first initialization. Attackers with network access to the application's login interface can gain full administrative control, managing VPN tunnels and system settings. This issue will be patched in version 2.0.2.

References

denpiligrim/3dp-manager commit f568de4 · Patch
denpiligrim/3dp-manager security advisory · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free