Session-Fixation-in-Vvveb-CMS-v1.0.6.1

Vvveb CMS v1.0.6.1 におけるセッション固定化 著者: Andrew Paul 発見日: 2025年6月9日 ベンダー: Vvveb ベンダーURL: http://vvveb.com ベンダーGitHub: https://github.com/givanz/Vvveb 影響を受けるバージョン: 1.0.6.1 およびそれ以前のバージョンの可能性が高い CVE ID: CVE-2025-8517 概要 Vvveb CMS バージョン 1.0.6.1 の認証メカニズムにおいて、CWE-384: セッション固定化...

Vvveb-CMS-CVE-2025-8518

Vvveb-CMS-CVE-2025-8518 このリポジトリには、givanz Vvveb 1.0.5 の重大な脆弱性を実証する Proof of Concept PoC が含まれています。この脆弱性により、テンプレート編集権限を持つ認証済みユーザーが、任意の PHP コードをサーバーファイルに書き込むことができ、リモートコード実行 RCE につながります。...

Reflected-XSS-in-Vvveb-CMS-v1.0.7.2

Vvveb CMS v1.0.7.2 登录表单（邮箱与密码字段）中的反射型 XSS 作者： Andrew Paul 发现日期： 2025年8月12日 厂商： Vvveb 厂商 URL： http://vvveb.com 厂商 GitHub： https://github.com/givanz/Vvveb 受影响版本： 1.0.7.2（以及可能更早的版本） CVE ID： CVE-2025-9728 概述 用户登录表单中存在反射型跨站脚本（XSS）漏洞（CWE-79：网页生成期间对输入的不当中和（'跨站脚本'））。email 和 password 参数在回显到 HTML...

CVE-2026-49225

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php...

PT-2026-77189

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

CVE-2026-45800

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and...

CVE-2026-44826

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positi...

CVE-2026-46407

Vvveb CMS contains an IDOR in the backend/admin/auth-token endpoint. An authenticated administrator can load another admin's REST API token list by supplying that user’s admin_id, leading to disclosure of sensitive tokens. The issue is fixed in version 1.0.8.3. No exploitation details are provide...

CVE-2026-45800

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and...

CVE-2026-45800 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and...

CVE-2026-45800 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and...

CVE-2026-45800 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and...

CVE-2026-45622 Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting XSS issue in the public product return form in Vvveb CMS. The customerorderid POST parameter is inserted into the...

CVE-2026-45622

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting XSS issue in the public product return form in Vvveb CMS. The customerorderid POST parameter is inserted into the...

CVE-2026-44366 Vvveb: Stored XSS via Comment Author Field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting XSS vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post...

CVE-2026-44366 Vvveb: Stored XSS via Comment Author Field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting XSS vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post...

CVE-2026-44366 Vvveb: Stored XSS via Comment Author Field

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting XSS vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post...

EUVD-2026-30588

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.1, a Stored Cross-Site Scripting XSS vulnerability exists in the Vvveb CMS comment submission flow. The author field is submitted by an unauthenticated user on any public post...

CVE-2026-44366

Vvveb CMS before version 1.0.8.1 is affected by a Stored XSS in the comment submission flow. An unauthenticated user can submit an author field on any public post page, which is stored without sanitization and later rendered unsanitized in two sinks. The issue is fixed in version 1.0.8.1. Remedia...

PT-2026-41370

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's admin id. This can...