En bref
- CVE-2026-42569 est une vulnérabilité CRITIQUE (CVSS 9.4) touchant nabeel/phpvms.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.5% des vulnérabilités.
- Correctif : mettre à jour vers 7.0.6 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| nabeel/phpvms Packagist | < 7.0.6
| 7.0.6
|
Description
Security Advisory: Unauthenticated Access to Legacy Import Feature
Severity: Critical
Affected versions: phpVMS 7.x (up to 7.0.5)
Fixed in: v7.0.6
Component: Legacy importer
Summary
A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.
Impact
A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:
- Data loss
- Service disruption
No authentication was required.
Remediation
- Update immediately to the latest patched version
- If unable to update:
- The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)
Affected Versions
- Affected: phpVMS 7.x ≤ 7.0.5
- Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)
NVD description
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free