HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-67595 — VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript p...

·Source: NIST NVD

Updated:

Executive Summary

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, install

Analysis

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript enabled. The payload establishes a WebSocket connection to a hardcoded command-and-control endpoint, installs a password-field keylogger using MutationObserver to capture dynamically added inputs, scrapes WhatsApp Web DOM content, and accepts remote commands to redirect or overwrite the rendered page. CVSS Score: 8.1. Published: 2026-07-29T22:16:52.667.

Indicators of Compromise (1)

CVE (1)
CVE-2026-67595
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 29, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Defcon Aerospace Village Seeks Broader Appeal This Year

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/defcon-aerospace-village-seeks-broader-appeal-this-year-image_small-2-a-32400.jpg" align=right hspace=4><b>That’s No Moon, It’s an Insecure PLC</b><br>The Aerospace Village at annual hacking conference Defcon, famed as the home of the Hack-A-Sat contest which culminated in 2023 with the live hacking of a real satellite in orbit, w

Bank Info Security
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-61524 — WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerabili...

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file. Attackers can place the malicious archive through the module installation interface, causing the applicat

CVE-2026-61524
NIST NVD
HIGHVulnerabilityNEW

NVD HIGH: CVE-2026-61523 — WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the D...

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated administrators to inject arbitrary PHP code by submitting malicious content through the droplet Code field, which is written verbatim to a publicly accessible PHP file with no content sanitization. Attackers can save a PHP webshell via the save_droplet handler to a predictable p

CVE-2026-61523
NIST NVD