Information Disclosure Vulnerability in Vvveb by Givanz
CVE-2026-41928

6.9MEDIUM

Key Information:

Vendor

Givanz

Status
Vvveb
Vendor
CVE Published:
7 May 2026

What is CVE-2026-41928?

Vvveb, a web development toolkit, prior to version 1.0.8.2 is susceptible to an information disclosure flaw in its cron controller. This vulnerability enables unauthenticated attackers to access sensitive application data, specifically the secret cron key. By exploiting this weakness, attackers can initiate scheduled tasks prematurely or without proper authorization, potentially leading to unauthorized actions within the application.

Affected Version(s)

Vvveb 0

References

https://github.com/givanz/Vvveb/commit/517bc09faf44136e72...
patch
https://www.vulncheck.com/advisories/vvveb-information-di...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Basant Kumar (@CyberWarrior9)
Hamed Kohi (@0xHamy)
VulnCheck
.