Webreinvent Vaahcms vulnerabilities

• webreinvent vaahcms VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php CVE-2026-67595 Public exploit 9.2 CriticalJuly 29, 2026
• webreinvent vaahcms VaahCMS is vulnerable to XSS through its Avatar Upload endpoint CVE-2025-61183 Public exploit 6.1 MediumOctober 8, 2025