Vvveb CMS CVE-2026-45800

Valid frontend user account credentials are required - the attacker must be able to authenticate and access the /user/orders endpoint. No special CMS configuration or non-default settings are needed beyond having user registration enabled. The vulnerability exists in default installations where authenticated users can view their order history. Anonymous users cannot exploit this issue.

The CVSS 4.0 score of 8.7 (High) reflects the serious impact potential, with the attack vector showing network accessibility (AV:N), low complexity (AC:L), and low privileges required (PR:L). The impact ratings are all High for confidentiality, integrity, and availability. However, the requirement for authenticated access significantly limits the attack surface compared to unauthenticated vulnerabilities. No EPSS score or KEV listing is available, and no public exploit code has been identified, suggesting this is not currently under active exploitation. The authentication requirement and lack of observed exploitation make this a lower priority than the CVSS score might suggest for external-facing deployments.

An attacker with valid frontend user credentials logs into the Vvveb CMS and navigates to the order history page at /user/orders. By manipulating the order_by or direction URL parameters with SQL injection payloads, they can extract sensitive data from the database, modify records, or potentially execute system commands depending on database permissions.