Vvveb EUVD-2026-27885

Requires Docker-based Vvveb deployment using the vulnerable docker-compose-apache.yaml configuration file with phpMyAdmin container enabled and network-accessible. The phpMyAdmin service port must be exposed to the attacker's network-this occurs by default in standard docker-compose deployments which map container ports to host interfaces. Specifically affects deployments that have not modified the default database credentials from the shipped configuration file. Does not affect Vvveb installations deployed through traditional web server configurations without Docker, or Docker deployments where administrators have customized database credentials and restricted phpMyAdmin port access. CVSS vector AT:P (Attack Requirements Present) confirms deployment-specific conditions rather than universal exploitability, but these conditions represent the default/recommended deployment method per vendor documentation, making large portions of the user base vulnerable.

Critical real-world risk with immediate action required. CVSS 9.2 accurately reflects the severity: network vector (AV:N), no authentication required (PR:N), low complexity (AC:L), with high confidentiality, integrity, and availability impacts. The AT:P (Attack Requirements Present) modifier indicates that while exploitation is straightforward, the phpMyAdmin port must be exposed-which is standard in Docker deployments following the provided configuration. This vulnerability grants complete database control equivalent to SQL injection but without needing to exploit application logic. The combination of Authentication Bypass and Docker tags confirms this affects containerized deployments specifically. No EPSS or KEV data provided, suggesting newly disclosed vulnerability not yet widely exploited, but the trivial exploitation path (direct port connection with known credentials) makes this automatable once deployments are discovered through port scanning. Patch availability in version 1.0.8.2 with specific commit f85ca7c2bc389bda3cc2eca87b2514581a628c32 provides clear remediation path. Highest priority for any organization running Vvveb in Docker, especially internet-facing deployments.

An attacker performs network reconnaissance scanning for exposed phpMyAdmin instances on Docker deployments (common ports 8080, 8081). Upon discovering a Vvveb installation, the attacker retrieves the hard-coded credentials from the publicly available docker-compose-apache.yaml file in the Vvveb GitHub repository. Using these credentials, they authenticate directly to phpMyAdmin and execute SQL queries to extract administrator password hashes, which they crack offline. With administrator access, they modify product prices, inject malicious JavaScript into page content for stored XSS attacks against customers, or exfiltrate complete customer databases including payment information and PII for sale on dark web markets.