by Kastro
Paper/Archive/CVE-2026-41930

CVE-2026-41930

givanz Vvveb — Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 28.3.283 × 205.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

Affected

ProductAffectedFixed inSource
Vvveb< 1.0.8.21.0.8.2CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/givanz/Vvveb/releases/tag/1.0.8.2exploitgithub.com/givanz/Vvveb/security/advisories/GHSA-g38h-mr9p-fjmfpatchgithub.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32writeupvulncheck.com/advisories/vvveb-hard-coded-credentials-information-disclosure-via-phpmyadmin