CVE-2026-41931

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41931

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41931.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41931

Aliases

GHSA-xgvg-r47g-786r

Published

2026-05-06T18:36:13Z

Modified

2026-08-12T03:51:10Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

Details

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1188",
        "CWE-209"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41931.json"
}

References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type

GIT

Repo

https://github.com/givanz/vvveb

Events

Introduced

Fixed

8b9db6a408ba35d8ac1dd078823c73f76584d78f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.8.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.7.1

1.0.7.2

1.0.7.3

1.0.8

1.0.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41931.json"