CVE-2026-41933: medium-severity vulnerability in givanz Vvveb
Vvveb < 1.0.8.3 Directory Listing Information Disclosure
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.4%
exploitation probability
0.4%top 65% of all CVEs
observed exploitation
nono source reports it
Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
givanz · VvvebRelated CVEs — givanz Vvveb
In the same product, most dangerous first.
CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.2%CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.1%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 1.1%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 1.0%CVE-2026-34427HIGHVvveb < 1.0.8.1 Privilege Escalation via admin/user/saveEPSS 1.0%CVE-2026-41934HIGHVvveb < 1.0.8.2 Authenticated RCE via Code EditorEPSS 1.0%