CVE-2026-41933
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
May 14, 2026
CISA due date
—
The record
Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19987 A security vulnerability has been detected in SourceCodester Best Employee Management… CWE-548
- CVE-2026-50233 Lyrion Music Server 9.2.0 contains an arbitrary directory listing vulnerability in its… CWE-548
- CVE-2025-32750 Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through… CWE-548
- CVE-2026-22860 Rack is a modular Ruby web server interface. CWE-548
- CVE-2023-38265 IBM Cloud Pak System 2.3.3.6, 2.3.3.7, 2.3.4.0, 2.3.4.1, and 2.3.5.0 could disclose… CWE-548
- CVE-2020-36921 RED-V Super Digital Signage System 5.1.1 contains an information disclosure vulnerability… CWE-548
- GHSA-c5cj-xp43-qcc3 Moodle's error handling leads to sensitive information disclosure CWE-548
- CVE-2025-62396 Moodle's error handling leads to sensitive information disclosure CWE-548