Which versions of Vvveb are affected by CVE-2026-41930?

Vvveb versions prior to 1.0.8.2 contain hard-coded credentials in Docker configurations that expose phpMyAdmin and the entire application database to unauthenticated remote access.. A patch is available.

Vvveb CVE-2026-41930

Q: What is the CVSS score of CVE-2026-41930?

CVE-2026-41930 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27885 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-05-06 VulnCheck

Authentication Bypass Apache Docker

9.2

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 19:46 vuln.today

Analysis Generated

May 06, 2026 - 19:46 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

9.8 (CRITICAL) 9.2 (CRITICAL)

CVE Published

May 06, 2026 - 18:37 nvd

CRITICAL 9.2

DescriptionNVD

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.

AnalysisAI

Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote attackers. Versions prior to 1.0.8.2 ship with pre-configured phpMyAdmin credentials in docker-compose-apache.yaml, allowing direct database access without authentication. …

RemediationAI

Within 24 hours: Identify all Vvveb instances and verify current version (check docker-compose-apache.yaml and application version information); immediately isolate any instance running versions prior to 1.0.8.2 from internet-facing access. Within 7 days: Deploy Vvveb version 1.0.8.2 or later across all affected systems; regenerate all phpMyAdmin credentials and database user passwords; conduct database access logs review for unauthorized activity. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory