Vulnerability · Published May 6, 2026 · Assigned by VulnCheck

CVE-2026-41930Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin

Critical 9.8

In plain English

A critical-severity missing authentication in Vvveb from givanz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	0 – before 1.0.8.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 release-notes
https://github.com/givanz/Vvveb/security/advisories/GHSA-g38h-mr9p-fjmf vendor-advisory
https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32 patch
https://www.vulncheck.com/advisories/vvveb-hard-coded-credentials-information-disclosure-via-phpmyadmin third-party-advisory