by Kastro
Paper/Archive/CVE-2026-42569

CVE-2026-42569

phpvms phpvms — phpvms: /importer authorization bypass causing full database wipe

EPSS 1%CVSS 9.4
critical.is priorityof 100
42
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 67.5.675 × 2013.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

Affected

ProductAffectedFixed inSource
phpvms< 7.0.6–CNA

Scores by source

GitHub_M (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fhrefgithub.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dcrefgithub.com/phpvms/phpvms/releases/tag/7.0.6refgithub.com/phpvms/phpvms/releases/tag/7.0.7