EUVD-2026-19160Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS score of 4.3 reflects low severity due to the requirement for user interaction (UI:R) and limited impact scope (C:N, I:L, A:N). However, several factors elevate real-world priority: the attack vector is network-based with low complexity (AV:N/AC:L), no authentication is required (PR:N), and a publicly available exploit exists (E:P per CVSS vector, POC confirmed). The SSVC framework would classify this as exploitable and automatable given POC availability, though technical impact is limited to integrity of the user's view. This is a genuine, exploitable vulnerability affecting an active component, but the requirement for user interaction and absence of CISA KEV listing suggests it is not yet confirmed in active widespread campaigns. Organizations using Vvvebjs should prioritize patching, but this is not a critical emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious link containing JavaScript code in the uploadAllowExtensions parameter of the file upload endpoint (e.g., upload.php?uploadAllowExtensions=<script>alert('xss')</script>) and sends it to a Vvvebjs user via email or social engineering. When the user clicks the link, the unvalidated parameter is reflected back in the response and executed in the user's browser, allowing the attacker to steal session cookies, modify page content, or redirect the user to a phishing site. Publicly available exploit code (https://tcn60zf28jhk.feishu.cn/wiki/Cr4KwMPiMi65fFkI9Vyc3oX2n0f) demonstrates the vulnerability and lowers the barrier for attackers. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 06, 2026
Cross-site scripting (XSS) in givanz Vvvebjs file upload endpoint allows unauthenticated remote attackers to inject malicious scripts via the uploadAllowExtensions parameter in upload.php. The vulnerability affects Vvvebjs versions up to 2.0.5 and requires user interaction (UI:R). A publicly available exploit exists and a patch (commit 8cac22cff99b8bc701c408aa8e887fa702755336) has been released by the vendor; EPSS exploitation likelihood is indicated as probable (E:P) with a CVSS score of 4.3.
RemediationAI
Vendor-released patch available: update to the fixed version following commit 8cac22cff99b8bc701c408aa8e887fa702755336 (https://github.com/givanz/VvvebJs/commit/8cac22cff99b8bc701c408aa8e887fa702755336). The vendor has released a patched version of Vvvebjs addressing this issue. If immediate patching is not possible, implement input validation and output encoding on all file upload parameters, specifically sanitizing the uploadAllowExtensions parameter to reject or escape any HTML/JavaScript metacharacters before reflecting them in responses. Additional details are available from VulDB (https://vuldb.com/vuln/355406).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Vvvebjs is a PHP-based web page builder component. The vulnerability resides in the file upload endpoint (upload.php), where insufficient input validation and output encoding on the uploadAllowExtensions parameter fails to sanitize or escape user-supplied data before reflection in the HTTP response. This is a classic reflected XSS flaw (CWE-79) where an attacker can craft a malicious URL containing JavaScript code in the uploadAllowExtensions parameter. When a user clicks the link or is redirected to it, the JavaScript executes in their browser context with the privileges of the authenticated user session, enabling session hijacking, credential theft, or malware delivery.
Know when Vvvebjs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc701c408aa8e887fa702755336. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute a
A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Rated low severity (CVSS 2.3
Exploit-DB