CVE-2026-41935 | BDVDB-2026-333336 Detail

Description#

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-14Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.