Threats tagged 'ghsa-8rhw-hq84-rcq7'

Vvveb versions before 1.0.8.2 have an information disclosure vulnerability in the cron controller. This flaw allows unauthenticated attackers to retrieve the application's secret cron key by accessing the cron controller without authentication. With the secret key exposed, attackers can trigger scheduled tasks outside the intended schedule. The vulnerability has a CVSS score of 5.3, indicating medium severity.