CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

EUVD-2026-82570

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

EUVD-2026-82569

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...

CVE-2026-54613

Vvveb is a CMS with a page builder for websites, blogs, and ecommerce stores. Prior to 1.0.8.5 , the function getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization. The method sanitizeBackupFileName() strips traversal charac...

CVE-2026-54507

Vvveb is a CMS with page builder. Prior to 1.0.8.5 , the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled URL parameter passed to getUrl(). The validateUrl() function in system/functions.php checks only the hostname string but does not validate resolved a...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

EUVD-2026-82567

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54612: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...

CVE-2026-54506: Improper Neutralization of Input During Web Page Generation

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the userbio field and passes stored content through sanitizeHTML in system/functions.php, whose on event-handler regular expression omi...

PT-2026-95144

Name of the Vulnerable Software and Affected Versions Vvveb versions 1.0.0 through 1.0.8.4 Description An authenticated user with the Editor role and editor/ permission can perform a path traversal attack. The saveGlobalElements function in admin/controller/editor/global-trait.php improperly...

PT-2026-95141

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description A flaw exists in the way user profile bios are processed. The file 'app/controller/user/profile.php' accepts the userbio field and processes it using the sanitizeHTML function in...

PT-2026-95142

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description The oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl. The validateUrl function in system/functions.php only checks the...

PT-2026-95145

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.5 Description An issue exists where the getThemeFolder function in admin/controller/editor/revisions.php returns the theme parameter without proper sanitization. The backupFolder function then concatenates this...

CVE-2026-54507: Server-Side Request Forgery (SSRF)

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54613: Improper Limitation of a Pathname to a Restricted Directory

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder concatenates it beneath DIRTHEME...