CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
- State
- Published
- Severity
- 9.2 Critical
- Published
- May 6, 2026
- Updated
- Jul 28, 2026
- Reserved
- Apr 22, 2026
Description
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.2 Critical | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
Vvvebgivanz |
|
References
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.2release-notes
- https://github.com/givanz/Vvveb/security/advisories/GHSA-g38h-mr9p-fjmfvendor-advisory
- https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32patch
- https://www.vulncheck.com/advisories/vvveb-hard-coded-credentials-information-disclosure-via-phpmyadminthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.