CVE-2026-42569

Summary

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

Affected Software

Weaknesses

• CWE-284: CWE-284: Improper Access Control
• CWE-306: CWE-306: Missing Authentication for Critical Function
• CWE-862: CWE-862: Missing Authorization

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/phpvms/phpvms/security/advisories/GHSA-fv26-4939-62fh
• https://github.com/phpvms/phpvms/commit/f59ba8e0e8fc25c60c3faf14e526cfd49df3f7dc
• https://github.com/phpvms/phpvms/releases/tag/7.0.6
• https://github.com/phpvms/phpvms/releases/tag/7.0.7

• ←Previous
• Next→