CVE-2024-29272

CVE-2024-29272 affects VvvebJs prior to 1.7.5. An unauthenticated attacker can upload arbitrary files via the sanitizeFileName parameter in save.php, enabling potential remote code execution and exposure of sensitive data. The CVSSv3.1 base score is 6.5 (Medium) with network attack vector, no pri...

CVE-2024-29271

VvvebJs (software/library) is affected by a reflected XSS vulnerability (CVE-2024-29271) present in versions before 1.7.7. The issue allows remote attackers to exfiltrate data or execute arbitrary code via the action parameter in save.php. Affected versions: VvvebJs

CVE-2025-8522

CVE-2025-8522 affects givanz Vvvebjs up to version 2.0.4, where a vulnerability in the node.js component allows path traversal via the File argument in the file /save.php. Remote exploitation is possible with high attack complexity; exploitability is reported as difficult, and a public exploit ex...

CVE-2024-25181

CVE-2024-25181 affects givanz VvvebJs 1.7.2. The issue stems from improper handling of user-supplied URLs in the file_get_contents call in save.php, enabling Server-Side Request Forgery (SSRF) and arbitrary file reading. The CVSSv3.1 base score is 9.1 (CRITICAL) with NETWORK_VECTOR, LOW attack co...

CVE-2024-25182

Affected software: givanz VvvebJs 1.7.2. The CVE describes a file upload vulnerability via save.php, with a CVSS v3.1 base score of 9.8 (CRITICAL), attack vector NETWORK, no user interaction, and impact to confidentiality, integrity, and availability (H, H, H). Root cause is a file upload flaw in...

CVE-2024-27480

CVE-2024-27480 involves givanz VvvebJs, version 1.7.2, which is vulnerable to an Insecure File Upload. The connected Red Hat/NVD entries confirm this specific version is affected and that the vulnerability can impact confidentiality, integrity, and availability (per CVSS 3.1 metrics: AV:N/AC:L/PR...

CVE-2024-25183

givanz VvvebJs 1.7.2 is affected by a Directory Traversal flaw in scan.php, potentially allowing unauthorized access to files/directories. Base score 7.5 (HIGH); exploit requires no user interaction. Remediation: update to a newer version that addresses the issue; as a workaround, restrict access...