CVE-2026-41931Medium· 5.3▾ TwilightPoC availableVvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can acc…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
Vvveb < 1.0.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41929Medium· 6.1Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
CVE-2026-41938High· 8.8Vvveb < 1.0.8.2 RCE via Media Upload Handler
CVE-2026-41936High· 8.1Vvveb < 1.0.8.2 XML External Entity Injection via Import
CVE-2026-41930Critical· 9.8Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
CVE-2026-41934High· 8.8Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
CVE-2026-41935High· 7.1Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service