CVE-2026-67595

CVE-2026-67595 — Embedded Malicious JavaScript in VaahCMS Security advisory for CVE-2026-67595 : an obfuscated JavaScript spyware payload shipped inside the official releases of VaahCMS a supply-chain / embedded-malicious-code issue, independently discovered and reported by Ilhomjon Rustamov...

CVE-2025-61183

CVE-2025-61183 XSS Almacenado en la Carga de Avatar de Usuario a través de Manejo Inseguro de SVG Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Almacenado en vaahcms, específicamente dentro de la interacción entre la lógica de carga de archivos en MediaController.php y el...

EUVD-2026-50570

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

Malicious Package

Overview webreinvent/vaahcms is a malicious package. via the security-otp.blade.php template. An attacker can execute unauthorized code in the browser of any recipient who renders the affected email template with JavaScript enabled by leveraging a malicious obfuscated JavaScript payload. This...

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595

VaahCMS versions 2.0.0–2.3.4 contain a malicious obfuscated JavaScript payload embedded in the security-otp.blade.php template used to render security OTP emails. The payload can run in any browser that renders the affected email with JavaScript enabled and establishes a WebSocket connection to a...

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595: Embedded Malicious Code

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

PT-2026-65916

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

VulnCheck KEV: CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

Cross-site Scripting

webreinvent/vaahcms is vulnerable to Cross-Site Scripting. The vulnerability is due to improper sanitization in the storeAvatar upload method of UserBase.php, where crafted input can be stored and later executed in a user’s browser, allowing a remote attacker to run arbitrary JavaScript code...

CVE-2025-61183

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

GHSA-Q769-PHQG-263R VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

VaahCMS is vulnerable to XSS through its Avatar Upload endpoint

Cross-Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

CVE-2025-61183

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

Exploit for CVE-2025-61183

CVE-2025-61183 Stored XSS in User Avatar Upload via Unsafe S...

CVE-2025-61183: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar method of UserBase.php...

PT-2025-41260

Name of the Vulnerable Software and Affected Versions vaahcms version 2.3.1 Description A cross-site scripting issue exists in vaahcms version 2.3.1. A remote attacker can potentially execute arbitrary code through the upload method within the storeAvatar function of the UserBase.php file...