Vulnerabilities

TI-2026-47756 CVE-2026-67595 · GHSA-m2cx-9w9f-2hm7

VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

MEDIUM 43

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00763 Published 2026-07-29 Fixed CWE-506

TI-2025-37952 CVE-2025-61183 · GHSA-q769-phqg-263r

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary…

MEDIUM 60

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00299 Published 2025-10-08 No fix listed CWE-79

Vulnerabilities

Filters

VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary…