EUVD-2026-84204
GHSA-rwrj-7jcx-wjhq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach backend verification endpoint
-
ExploitSubmit malformed/unexpected input
-
ExecutionTrigger wrong-type return error
-
ImpactRead sensitive data in error response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to invoke the specific backend verification function in crmeb_zzff_class 1.4.4 that returns the wrong value type; the malformed/unexpected input must drive that function into the error path so the resulting error message exposes sensitive data (classic CWE-209 verbose-error leakage). Limiting factors: this is confined to version 1.4.4 of the crmeb_zzff_class knowledge-paid module, impact is read-only disclosure (no integrity or availability effect), and reaching a 'backend' routine typically implies the attacker must already reach an administrative/backend code path or endpoint - the input's AV:L/PR:N labeling is self-contradictory and the true access requirement (local vs. network, authenticated vs. not) is not confirmed from the available data. |
| Impact | This is a moderate-severity information disclosure (CWE-209, error-message leakage) in the niche CRMEB Knowledge-Paid System (crmeb_zzff_class) v1.4.4, and the signals consistently point to LOW real-world priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 6.2) is internally inconsistent and should be treated with caution: a web-application backend verification flaw rated AV:L (local) alongside PR:N (no privileges) is unusual, since a 'backend verification function' typically implies either network reachability (AV:N) or an authenticated backend context (PR:L) - the pairing of local vector with no authentication is questionable and the C:H rating is aggressive for a CWE-209 error-message leak that usually discloses only partial data. EPSS is very low at 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit was provided, so there is no public exploit identified at time of analysis. No signals conflict in a way that raises urgency - a low-CVSS-adjacent, low-EPSS, non-KEV flaw in an obscure product. Net: a genuine but low-priority defect, not an emergency. |
| Exploit ScenarioDerived | An actor able to reach the affected backend verification routine in crmeb_zzff_class 1.4.4 submits input that drives the function to return an incorrect value type, triggering an application error. The resulting error output discloses sensitive internal information (e.g., stack traces, configuration, or data) that aids further reconnaissance. No public exploit code was identified, and successful exploitation depends on reaching the backend code path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Information disclosure in CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 allows an attacker to trigger a backend verification function that returns an incorrect value type, causing an error that leaks sensitive information. The assessed vector indicates low-privilege network access (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), but the true access requirements (local vs. network, authenticated vs. unauthenticated) are not confirmed from available data. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), indicating low real-world priority.
RemediationAI
No vendor-released patch identified at time of analysis. To mitigate, disable detailed error reporting in production (e.g., set display_errors=Off in PHP) and ensure backend verification functions handle type errors gracefully without exposing internal data. Restrict access to administrative or backend endpoints to trusted networks or authenticated users only, as the vulnerable function is part of backend verification. Trade-off: mass-disabling error reporting can hinder debugging; consider logging errors to a secure location instead of displaying them. Monitor the GitHub repository and the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-88467) for updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the crmeb_zzff_class module of CRMEB, a PHP-based knowledge-paid system. A backend verification function returns an unexpected value type (e.g., string vs. array), triggering an error path that includes sensitive data in the error message, which is a classic instance of CWE-209 (Generation of Error Message Containing Sensitive Information). The assessed vector suggests network reachability with low privileges (AV:N/AC:L/PR:L), but the originally provided vector (AV:L/PR:N) is self-contradictory, so the actual attack vector and authentication requirement remain uncertain. Impact is read-only disclosure with no integrity or availability effect.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Backend verification routine implies an authenticated backend path (PR:L) reachable over the network (AV:N); CWE-209 error leakage is typically partial disclosure (C:L), with no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB