Home

Description

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

PUBLISHED Reserved 2026-04-22 | Published 2026-05-06 | Updated 2026-05-08 | Assigner VulnCheck




CRITICAL: 9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Missing Authentication for Critical Function

Product status

Default status
affected

Any version before 1.0.8.2
affected

Credits

Basant Kumar (@CyberWarrior9) finder

Hamed Kohi (@0xhamy) finder

VulnCheck finder

References

github.com/.../Vvveb/security/advisories/GHSA-g38h-mr9p-fjmf exploit

github.com/givanz/Vvveb/releases/tag/1.0.8.2 release-notes

github.com/.../Vvveb/security/advisories/GHSA-g38h-mr9p-fjmf vendor-advisory

github.com/...ommit/f85ca7c2bc389bda3cc2eca87b2514581a628c32 patch

www.vulncheck.com/...s-information-disclosure-via-phpmyadmin third-party-advisory

cve.org (CVE-2026-41930)

nvd.nist.gov (CVE-2026-41930)

Download JSON