CVE-2026-126323

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET...

CVE-2026-126369

Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML. Attackers can save post or product content with unclosed event-handler tags or javascript entities to...

CVE-2026-126370

Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted siteadmin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the mod...

CVE-2026-126371

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in AdminAuthTokenSQL::update, which interpolates adminauthtoken array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the...

CVE-2026-126372

Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or siteadmin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile...

CVE-2026-126373

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a postid, languageid, and createdat timestamp to retrieve private unpublished drafts, because...

CVE-2026-126374

Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS:each macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and adminauthtoken.sql omit the @FILTER guard. Authenticated back-office...

CVE-2026-126375

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digitalassets directory. Attackers can send rename, delete, or upload requests to product/digital-asset...

CVE-2026-126376

Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing adminid owner scoping. Attackers can supply filteradminid to list drafts, invoke duplicate on posts or products, or enumerate every...

CVE-2026-126377

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge...

CVE-2026-126378

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile function that uses strpos instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx...

CVE-2026-126379

Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud...

CVE-2026-126380

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary ...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 This repository contains a Proof of Concept PoC demonstrating a critical vulnerability in givanz Vvveb 1.0.5. The vulnerability allows an authenticated user with template editing privileges to write arbitrary PHP code to server files, leading to Remote Code Execution RCE...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Session Fixation in Vvveb CMS v1.0.6.1 Author: Andrew Paul Date of Discovery: June 9th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.6.1 and likely prior versions CVE ID: CVE-2025-8517 Summary A Session Fixation vulnerability...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Reflected XSS in Login Form Email & Password Fields Vvveb CMS v1.0.7.2 Author: Andrew Paul Date of Discovery: August 12th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.7.2 and likely prior versions CVE ID: CVE-2025-9728 Summa...

CVE-2026-112905

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...

CVE-2026-110799

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been...

CVE-2026-112905 Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in versi...

CVE-2026-112905

The Vvveb CMS (versions prior to 1.0.8.7 ) is vulnerable to an Insecure Direct Object Reference (IDOR) on the admin/auth-token endpoint. This vulnerability allows an authenticated administrator to read and overwrite the API tokens of other administrators, potentially leading to admin privilege es...