CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54506

Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...

CVE-2026-54612

Vvveb (a CMS with page builder) versions 1.0.0 through 1.0.8.5 are affected by an authenticated path traversal to arbitrary PHP file write in saveGlobalElements() (admin/controller/editor/global-trait.php). The attacker-controlled file portion of data-v-save-global is concatenated to the active t...

CVE-2026-54613

Vvveb is a CMS with a page builder for websites, blogs, and ecommerce stores. Prior to 1.0.8.5 , the function getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization. The method sanitizeBackupFileName() strips traversal charac...

CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...

CVE-2026-54507

Vvveb is a CMS with page builder. Prior to 1.0.8.5 , the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled URL parameter passed to getUrl(). The validateUrl() function in system/functions.php checks only the hostname string but does not validate resolved a...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Reflected XSS in Login Form Email & Password Fields Vvveb CMS v1.0.7.2 Author: Andrew Paul Date of Discovery: August 12th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.7.2 and likely prior versions CVE ID: CVE-2025-9728 Summa...

Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Session Fixation in Vvveb CMS v1.0.6.1 Author: Andrew Paul Date of Discovery: June 9th, 2025 Vendor: Vvveb Vendor URL: http://vvveb.com Vendor GitHub: https://github.com/givanz/Vvveb Affected Version: 1.0.6.1 and likely prior versions CVE ID: CVE-2025-8517 Summary A Session Fixation vulnerability...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 This repository contains a Proof of Concept PoC demonstrating a critical vulnerability in givanz Vvveb 1.0.5. The vulnerability allows an authenticated user with template editing privileges to write arbitrary PHP code to server files, leading to Remote Code Execution RCE...

CVE-2026-49225

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

CVE-2026-49228

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

CVE-2026-49222

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49224

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...

CVE-2026-49223

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223

Vvveb CMS (versions before 1.0.8.4) has an authorization bypass in admin/sql/sqlite/product_review.sql, which accepts a caller-controlled product_review_id without verifying ownership against the current admin's admin_id. A low-privileged Vendor can read, edit, approve, or delete reviews under an...

EUVD-2026-61039

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...

EUVD-2026-61038

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...