---
id: CVE-2026-41930
title: Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
summary: >-
  Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability
  in its docker-compose-apache.yaml configuration that allows unauthenticated
  attackers to access the bundled phpMyAdmin container with pre-configured
  database cr…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: givanz
product: Vvveb
affected:
  - Vvveb < 1.0.8.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-05-06T19:33:47.958860Z'
published: '2026-05-06'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:08.850Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-41930'
references:
  - url: 'https://github.com/givanz/Vvveb/releases/tag/1.0.8.2'
    label: Vvveb 1.0.8.2 Release Notes
  - url: 'https://github.com/givanz/Vvveb/security/advisories/GHSA-g38h-mr9p-fjmf'
    label: GitHub Security Advisory (GHSA-g38h-mr9p-fjmf)
  - url: >-
      https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32
  - url: >-
      https://www.vulncheck.com/advisories/vvveb-hard-coded-credentials-information-disclosure-via-phpmyadmin
tags:
  - cve.org
epss: 0.00347
epssPercentile: 0.28492
ingestedAt: '2026-11-08T14:51:22.436Z'
---

## Overview

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

## Affected

- `Vvveb < 1.0.8.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.