vaahcms vulnerabilities

CVEs whose affected-version data names the vaahcms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-67595High· 8.1PoC

1mo ago

VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser th…

▾ Midnightwebreinvent · vaahcmsEPSS 0.53%via CVEORG