CVE-2026-126371

Vvveb versions through 1.0.8.6 are vulnerable to an SQL injection flaw in the Admin_Auth_TokenSQL::update() function. The root cause is the interpolation of admin_auth_token array keys into an INSERT column list without utilizing a column whitelist or backtick escaping. Authenticated admin-panel ...