CVE-2026-41936

Katalog CVE

CVSS 8.1 · High EPSS 0,49%

Kerentanan Improper Restriction of XML External Entity Reference. Skor CVSS 3.1 8.1 (High) menurut vulncheck.com.

Deskripsi (NVD)

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.

Rincian

Terbit di NVD

6 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.1 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-611: Improper Restriction of XML External Entity Reference

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2
• https://github.com/givanz/Vvveb/security/advisories/GHSA-rfxr-4xpm-wrp7
• https://www.vulncheck.com/advisories/vvveb-xml-external-entity-injection-via-import