CVE-2026-41930criticalCWE-306

CVE-2026-41930: critical vulnerability in givanz Vvveb

Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin

Published · Updated

Follow this CVE+ Monitor Vvveb

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.3%
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
givanz · Vvveb
Related CVEs — givanz Vvveb

In the same product, most dangerous first.

CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.6%CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.5%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%