324 matches found
CVE-2026-54612
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...
CVE-2026-54507
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
CVE-2026-54506
Vvveb CMS prior to 1.0.8.5 is affected by a stored XSS vulnerability in the user profile bio field. The root cause lies in sanitizeHTML() in system/functions.php, where the on* event-handler regex omits the forward-slash delimiter and the do-while loop compares the string to itself, causing forbi...
CVE-2026-54612 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory...
CVE-2026-54612
Vvveb (a CMS with page builder) versions 1.0.0 through 1.0.8.5 are affected by an authenticated path traversal to arbitrary PHP file write in saveGlobalElements() (admin/controller/editor/global-trait.php). The attacker-controlled file portion of data-v-save-global is concatenated to the active t...
CVE-2026-54613
Vvveb is a CMS with a page builder for websites, blogs, and ecommerce stores. Prior to 1.0.8.5 , the function getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization. The method sanitizeBackupFileName() strips traversal charac...
CVE-2026-54507 Vvveb oEmbedProxy vulnerable to server-side request forgery
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl, while validateUrl in system/functions.php...
CVE-2026-54507
Vvveb is a CMS with page builder. Prior to 1.0.8.5 , the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled URL parameter passed to getUrl(). The validateUrl() function in system/functions.php checks only the hostname string but does not validate resolved a...
Reflected-XSS-in-Vvveb-CMS-v1.0.7.2
XSS Reflejado en el Formulario de Inicio de Sesión Campos de Correo Electrónico y Contraseña Vvveb CMS v1.0.7.2 Autor: Andrew Paul Fecha de descubrimiento: 12 de agosto de 2025 Proveedor: Vvveb URL del proveedor: http://vvveb.com GitHub del proveedor: https://github.com/givanz/Vvveb Versión...
Session-Fixation-in-Vvveb-CMS-v1.0.6.1
Vvveb CMS v1.0.6.1 中的会话固定漏洞 作者: Andrew Paul 发现日期: 2025年6月9日 厂商: Vvveb 厂商URL: http://vvveb.com 厂商GitHub: https://github.com/givanz/Vvveb 受影响版本: 1.0.6.1(可能包括更早版本) CVE ID: CVE-2025-8517 摘要 在Vvveb CMS 1.0.6.1版本的认证机制中发现了一个会话固定漏洞,分类为CWE-384:...
Vvveb-CMS-CVE-2025-8518
Vvveb-CMS-CVE-2025-8518 Este repositorio contiene una Prueba de Concepto PoC que demuestra una vulnerabilidad crítica en givanz Vvveb 1.0.5. La vulnerabilidad permite a un usuario autenticado con privilegios de edición de plantillas escribir código PHP arbitrario en archivos del servidor, lo que...
CVE-2026-49225
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...
CVE-2026-49228
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...
CVE-2026-49222
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...
CVE-2026-49223
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49224
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controll...
CVE-2026-49223 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...
CVE-2026-49223
Vvveb CMS (versions before 1.0.8.4) has an authorization bypass in admin/sql/sqlite/product_review.sql, which accepts a caller-controlled product_review_id without verifying ownership against the current admin's admin_id. A low-privileged Vendor can read, edit, approve, or delete reviews under an...
EUVD-2026-61039
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/productreview.sql queries accept ...