PT-2026-38219 · Unknown+1 · Phpmyadmin+1

Basant Kumar + 2 · Published 2026-05-06 · Updated 2026-05-13 · CVE-2026-41930

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description A hard-coded credentials issue exists in the docker-compose-apache.yaml configuration. This allows unauthenticated attackers to access the bundled phpMyAdmin container using pre-configured database credentials. By connecting to the phpMyAdmin port, attackers can obtain unrestricted read and write access to the entire database, including administrator password hashes, customer personally identifiable information, and order data, which can lead to account takeover and data manipulation.

Recommendations Update to version 1.0.8.2 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-41930

Affected Products

Vvveb

Phpmyadmin

References · 12

• 🔥 https://github.com/givanz/Vvveb/security/advisories/GHSA-g38h-mr9p-fjmf · Exploit
• https://github.com/givanz/Vvveb/commit/f85ca7c2bc389bda3cc2eca87b2514581a628c32 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41930 · Security Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.2 · Note
• https://twitter.com/lyrie_ai/status/2054365974669783308 · Twitter Post
• https://twitter.com/OrizonCyber/status/2052108668066292115 · Twitter Post
• https://twitter.com/CVEnew/status/2052112620535071077 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2052245139209253372 · Twitter Post
• https://vulncheck.com/advisories/vvveb-hard-coded-credentials-information-disclosure-via-phpmyadmin · Note
• https://twitter.com/KaitanSecurity/status/2052108647082160177 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054365973017239852 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054365973851820044 · Twitter Post