Is there a public PoC exploit available for CVE-2026-34429?

Yes, a public proof-of-concept exploit is available for CVE-2026-34429. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-34429?

Yes, a patch is available for CVE-2026-34429. Update the affected software to the latest version immediately.

Vvveb CVE-2026-34429

Q: What is the CVSS score of CVE-2026-34429?

CVE-2026-34429 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23854 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-20 VulnCheck

XSS RCE Vvveb

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

PoC Detected

Apr 20, 2026 - 18:54 vuln.today

Public exploit code

CVSS changed

Apr 20, 2026 - 16:22 NVD

5.4 (MEDIUM) 5.1 (MEDIUM)

Analysis Generated

Apr 20, 2026 - 15:04 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 14:45 euvd

EUVD-2026-23854

Analysis Generated

Apr 20, 2026 - 14:45 vuln.today

Patch released

Apr 20, 2026 - 14:45 nvd

Patch available

CVE Published

Apr 20, 2026 - 13:54 nvd

MEDIUM 5.1

DescriptionCVE.org

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded files to executable extensions. Attackers can prepend a GIF89a header to HTML/JavaScript payloads to bypass upload validation, rename the file to .html extension, and execute malicious scripts in an administrator's browser session to create backdoor accounts and upload malicious plugins for remote code execution.

AnalysisAI

Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript in administrator browsers by bypassing MIME type validation with a GIF89a header prepend, renaming files to .html extensions, and injecting malicious payloads that can create backdoor accounts or upload remote code execution plugins. Publicly available exploit code exists and vendor-released patch 1.0.8.1 is available. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-34429 vulnerability details – vuln.today

Back