VULNERABILITY INTELLIGENCE
CVE-2026-41931
CVSS score6.9 MEDIUM
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-05-06
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.
Weakness classification
- CWE-209: Generation of Error Message Containing Sensitive Information
- CWE-1188: Initialization of a Resource with an Insecure Default