givanz Vvveb up to 1.0.8.1 information expsure

Summaryinfo

A vulnerability classified as problematic has been found in givanz Vvveb. This vulnerability affects unknown code. This manipulation causes information expsure. The identification of this vulnerability is CVE-2026-41928. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in givanz Vvveb. It has been declared as problematic. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a information expsure vulnerability. The CWE definition for the vulnerability is CWE-497. The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does. As an impact it is known to affect confidentiality. The summary by CVE is:

Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule.

The weakness was shared by Basant Kumar as 517bc09faf44136e72de391aacc8b90a706f7ae7. The advisory is shared at github.com. This vulnerability is known as CVE-2026-41928 since 04/22/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 1.0.8.2 eliminates this vulnerability. Applying the patch 517bc09faf44136e72de391aacc8b90a706f7ae7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1

License

• open-source

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion