Vvveb versions earlier than 1.0.8.2 store hard‑coded administrator credentials in a docker‑compose configuration that launches a phpMyAdmin container. Because the credentials are embedded, an unauthenticated attacker who can reach the phpMyAdmin port can log in automatically, gaining unrestricted read and write privileges against the entire Vvveb database. This enables retrieval of administrator password hashes, customer personal data, and order information, and permits arbitrary data modification, leading to account takeover and data tampering. The weakness is categorized as CWE‑306.

The affected product is Vvveb supplied by givanz. Any installation that uses the bundled phpMyAdmin container and remains at a version prior to 1.0.8.2 is vulnerable. Deployments that have upgraded to 1.0.8.2 or later have removed the hard‑coded credentials and are not affected.

The vulnerability carries a CVSS score of 9.2, indicating critical severity. EPSS data is not available, but the lack of a KEV listing does not diminish the potential for exploitation. Attackers can reach the phpMyAdmin service from any network that exposes the container, then connect to the database with full privilege, exfiltrating or altering sensitive data. The exploitation requires no prior authentication, so it is accessible to any remote actor.