CVE-2026-41932

CVE-2026-41932 affects Vvveb prior to 1.0.8.3. The Signup::addUser() controller copies raw POST username values into the display_name field before sanitization, so HTML/script submitted in the username during signup is stripped in the username column but stored verbatim in display_name. When disp...

CVE-2026-41932: Improper Neutralization of Input During Web Page Generation

Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser controller copies raw POST username values into the displayname field before sanitization occurs. Attackers can submit HTML and script markup in the username field durin...