https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T23:11:41.595099+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-317413 EUVD-2026-317413 2026-10-12T23:11:41.650549+00:00 EUVD-2026-317413 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42569 fkie_cve-2026-42569 2026-10-12T23:11:41.650584+00:00

phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.

 https://cve.radiocsirt.org/vuln/ghsa-fv26-4939-62fh GHSA-fv26-4939-62fh — phpVMS has an /importer authorization bypass causing full database wipe 2026-10-12T23:11:41.650616+00:00

Affected: Packagist: nabeel/phpvms

# Security Advisory: Unauthenticated Access to Legacy Import Feature

**Severity:** Critical **Affected versions:** phpVMS 7.x (up to 7.0.5) **Fixed in:** v7.0.6 **Component:** Legacy importer

## Summary

A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.

## Impact

A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:

- Data loss - Service disruption

No authentication was required.

## Remediation

- **Update immediately** to [the latest patched version](https://github.com/phpvms/phpvms/releases/tag/7.0.7) - If unable to update: - The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)

## Affected Versions

* Affected: phpVMS 7.x ≤ 7.0.5 * Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)