CVE-2026-42569

CriticalCVSS 9.4

Published: 09/05/2026(UTC)Updated: 20/07/2026(UTC)Translated: 21/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.17%

64th percentile - higher than 64% of all known CVEs

Summary

A critical vulnerability in phpVMS before version 7.0.6 allows unauthenticated attackers to access a legacy import feature. This issue has been patched in version 7.0.6.

Risk Assessment

An unauthenticated attacker can exploit this vulnerability to perform unauthorized data imports, potentially leading to system integrity compromise and possible takeover of the application.

Recommendation

Immediately update phpVMS to version 7.0.6 or later. If an update is not possible, temporarily disable or block access to the legacy import feature.

Original NVD description (English source)

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.