Skip to main content

Vaahcms

1 CVEs product

Monthly

CVE-2026-67595 Jul 29, 21:33 CRITICAL POC PATCH Act Now

Embedded malicious JavaScript (a supply-chain backdoor) in VaahCMS 2.0.0-2.3.4 executes attacker-controlled code in any browser that renders the security-OTP Blade email template with JavaScript enabled, reported by VulnCheck and rated CVSS 4.0 9.2. The obfuscated payload opens a WebSocket to a hardcoded command-and-control endpoint, keylogs password fields via a MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the malicious code ships in the product itself, so exposure is inherent to running an affected version.

Authentication Bypass Vaahcms
NVD GitHub VulDB
CVSS 4.0
9.2
EPSS
0.4%
EPSS 0% CVSS 9.2
CRITICAL POC PATCH Act Now

Embedded malicious JavaScript (a supply-chain backdoor) in VaahCMS 2.0.0-2.3.4 executes attacker-controlled code in any browser that renders the security-OTP Blade email template with JavaScript enabled, reported by VulnCheck and rated CVSS 4.0 9.2. The obfuscated payload opens a WebSocket to a hardcoded command-and-control endpoint, keylogs password fields via a MutationObserver, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the malicious code ships in the product itself, so exposure is inherent to running an affected version.

Authentication Bypass Vaahcms
NVD GitHub VulDB

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy