Vulnerability · Published May 9, 2026 · Assigned by GitHub_M

CVE-2026-42569phpvms: /importer authorization bypass causing full database wipe

Critical 9.4

In plain English

A critical-severity improper access control in phpvms from phpvms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.4Critical

Exploit odds (30 days)1.2%top 32.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	nabeel/phpvms	7.0.6	GHSA-fv26-4939-62fh

Affected products (as reported)

Vendor	Product	Versions
phpvms	phpvms	< 7.0.6

Weakness: CWE-284, CWE-306, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

References

https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh x_refsource_CONFIRM
https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc x_refsource_MISC
https://github.com/phpvms/phpvms/releases/tag/7.0.6 x_refsource_MISC
https://github.com/phpvms/phpvms/releases/tag/7.0.7 x_refsource_MISC