CVE-2026-41935 — Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers…
Published: 2026-05-14 · CVSS: 7.1 · CVSS 4.0
Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7