EUVD-2026-125187

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile function that uses strpos instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx...