CVEvulnerability

CVE-2026-42569

9.4 CRITICAL Published 2026-05-09 Modified 2026-07-20 Official page ↗

Status: Deferred
Published: 2026-05-09
Last modified: 2026-07-20
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.4 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Weaknesses: CWE-284, CWE-306, CWE-862

Description

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

Weakness · CWE (3)

CWE-284 Improper Access Control weakness
CWE-306 Missing Authentication for Critical Functionality weakness
CWE-862 Missing Authorization weakness

References

https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc github.com
https://github.com/phpvms/phpvms/releases/tag/7.0.6 github.com
https://github.com/phpvms/phpvms/releases/tag/7.0.7 github.com
https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh github.com

CVE-2026-42569

Description

Related

Weakness · CWE (3)

References