EUVD-2026-30580Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend cart-add request with negative quantity
-
ExploitServer accepts and processes negative value
-
ExecutionNegative total propagates through order
-
ImpactFraudulent order created with merchant debt
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Input size validation
|
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of Vvveb CMS ecommerce stores. The only requirement is that the target site must have the ecommerce/cart functionality enabled and accessible. The vulnerability exists in the standard cart-add endpoint without requiring any special configuration, authentication, or user interaction. |
| Impact | The CVSS 3.1 score of 7.5 (High) reflects network-based, unauthenticated exploitation with no user interaction required, focused on integrity impact. The attack vector (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation against any internet-facing Vvveb store. However, the impact is limited to financial fraud rather than system compromise. No active exploitation has been reported (not in CISA KEV), and no public exploit code is identified. The risk is highest for production ecommerce sites where fraudulent negative-value orders could result in actual financial loss if merchants process refunds based on the corrupted order data. |
| Exploit ScenarioDerived | An attacker sends a POST request to the cart-add endpoint with a negative quantity value (e.g., -100) for a high-value product. The system calculates a negative line total, resulting in a cart with a large negative grand total that appears as merchant debt to the customer, which could be exploited to request fraudulent refunds. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 15, 2026
Negative quantity manipulation in Vvveb CMS versions before 1.0.8.2 allows unauthenticated remote attackers to create orders with negative totals, potentially defrauding merchants. The cart-add endpoint accepts negative quantity values that propagate through the entire order flow, creating legitimate-looking orders where the merchant appears to owe money to the customer. Fixed in version 1.0.8.2.
RemediationAI
Upgrade Vvveb CMS to version 1.0.8.2 or later, which includes the fix for this vulnerability. The patch is available through the official Vvveb repository as referenced in GitHub advisory GHSA-75x2-j47j-mg8j. As an immediate workaround, implement server-side validation to reject any cart-add requests with non-positive quantity values, though this requires custom code modifications. Additionally, review existing orders for any entries with negative totals and implement business process controls to flag suspicious orders before payment processing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vvveb is a CMS platform with built-in ecommerce functionality for creating online stores. The vulnerability stems from missing input validation on the quantity parameter in the shopping cart API endpoint. This is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), where the application fails to enforce that quantity values must be positive integers. The negative values are treated as valid throughout the order processing pipeline, affecting line items, subtotals, taxes, and final totals.
Know when Vvveb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total - an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.
Executive ViewAI
Vvveb CMS versions before 1.0.8.2 contain a critical flaw allowing attackers to manipulate order quantities to negative values, enabling fraudulent transactions where merchants owe money to customers instead of receiving payment. This directly impacts revenue, merchant trust, and financial reconciliation for any organization running affected Vvveb CMS deployments.
Implement input validation at the application layer to reject negative quantity values before order processing; deploy Web Application Firewall (WAF) rules to block cart-add requests containing negative integers; configure monitoring to flag and alert on orders with zero or negative totals before payment processing; manually review suspicious orders matching this pattern. Note: These controls are temporary mitigations only-upgrade to version 1.0.8.2 is required for permanent remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Rated critica
A vulnerability was found in givanz Vvveb 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploi
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute a
A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.5), this vulnerability
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability
Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as ww
Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP co
Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote att
Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permission
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, d
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access,
Exploit-DB