CVE-2026-41934High· 8.8▾ TwilightVvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions,…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.
Vvveb < 1.0.8.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41929Medium· 6.1Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
CVE-2026-41931Medium· 5.3Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
CVE-2026-41930Critical· 9.8Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
CVE-2026-41938High· 8.8Vvveb < 1.0.8.2 RCE via Media Upload Handler
CVE-2026-41936High· 8.1Vvveb < 1.0.8.2 XML External Entity Injection via Import
CVE-2026-34428High· 7.7Vvveb < 1.0.8.1 SSRF via oEmbedProxy