Threats Tagged 'cve-2026-41935'

Vvveb versions before 1. 0. 8. 3 have an uncontrolled recursion vulnerability in the admin controller dispatch cycle. The Base::init() function repeatedly calls permission() on error handlers, causing infinite recursion that exhausts PHP memory limits. An attacker with low privileges can exploit this by sending repeated requests to forbidden admin URLs, leading to denial of service by exhausting memory on all workers. This vulnerability has a high severity rating with a CVSS score of 7. 1. No official patch or remediation guidance is currently available from the vendor. No known exploits are reported in the wild.