CVE-2026-41931

Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

State: Published
Severity: 6.9 Medium
Published: May 6, 2026
Updated: Jul 28, 2026
Reserved: Apr 22, 2026

Description

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	VulnCheck

Weaknesses

CWE-1188 Initialization of a Resource with an Insecure Default
CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
Vvvebgivanz	before 1.0.8.2Affected

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.2release-notes
https://github.com/givanz/Vvveb/security/advisories/GHSA-xgvg-r47g-786rvendor-advisory
https://www.vulncheck.com/advisories/vvveb-information-disclosure-via-debug-exception-handlerthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.