CVE-2026-126374

The Vvveb application (versions through 1.0.8.6 ) is vulnerable to an SQL injection flaw. The root cause is that the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without proper escaping. Additionally, certain procedures in admin/sql/mysqli/product.sql and admin_a...