CVE-2026-41930
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
- Affected products
- Vvveb, Phpmyadmin
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 0.3% (27th percentile)
- Weakness
- CWE-306
- NVD status
- Deferred
- Published
- 2026-05-06
No indexed exploits for CVE-2026-41930 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-41930 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.