要点
- CVE-2026-42569 は nabeel/phpvms に影響する深刻度「緊急」 (CVSS 9.4) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：1.2%（全脆弱性の 67.5% より高い）。
- 対処：7.0.6 以降に更新してください。
概要
Security Advisory: Unauthenticated Access to Legacy Import Feature
Severity: Critical
Affected versions: phpVMS 7.x (up to 7.0.5)
Fixed in: v7.0.6
Component: Legacy importer
Summary
A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.
Impact
A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:
- Data loss
- Service disruption
No authentication was required.
Remediation
- Update immediately to the latest patched version
- If unable to update:
- The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)
Affected Versions
- Affected: phpVMS 7.x ≤ 7.0.5
- Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)
NVD の説明
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン