Vvveb CVE-2025-11944

Upgrade Vvveb to a version released after commit 52204b4a106b2fb02d16eee06a88a1f2697f9b35 (exact version number not independently confirmed; verify with vendor for next stable release). This patch sanitizes SQL input in the Raw SQL Handler import function. As an interim compensating control, restrict network access to the admin/controller/tools/import.php endpoint using firewall rules or web application firewall (WAF) to limit access to trusted internal networks only; this reduces remote attack surface while maintaining administrative functionality. Additionally, implement strict administrative access controls: enforce multi-factor authentication (MFA) for administrator accounts, conduct regular access reviews to remove unnecessary high-privilege accounts, and enable comprehensive audit logging of all administrative actions including import function usage. These controls address the high-privilege requirement (PR:H) that limits real-world exploitation. Monitor application logs for SQL error messages or unusual import activity that may indicate exploitation attempts.