Vvveb CMS EUVD-2026-82571

Requires an authenticated account with Author role or higher on the Vvveb instance (PR:L) to write the malicious bio, and a victim must subsequently view the rendered bio on /author/{username}, the admin user-management view, or possibly a comment display (UI:R). Exploitation depends on the vulnerable single-pass sanitizeHTML() in versions prior to 1.0.8.5; upgrading to 1.0.8.5 fully removes the flaw. The stored payload uses solidus-prefixed event-handler markup or nested forbidden tags specifically crafted to defeat the mis-delimited regex and the non-iterating do-while loop. Limiting factors: the Author-role trust barrier and the need for a victim to load attacker-controlled content mean this is not exploitable by fully unauthenticated attackers against untouched pages.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Vvveb CMS user-profile bio field. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, 7.6 High) is internally consistent with the description: network-reachable, low complexity, requires an authenticated Author-or-higher account (PR:L), depends on a victim viewing the poisoned page (UI:R), and crosses a scope boundary into victim browser sessions (S:C) yielding session-data theft (C:H) and limited integrity impact via victim-context actions (I:L). No EPSS score, SSVC decision data, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world priority is moderated by two gates that CVSS partially reflects: the attacker must already hold an Author role (a meaningful trust barrier in most deployments), and a victim must render the stored bio. However, the root cause is precisely documented and confirmed by the fix commit (a regex missing the '/' delimiter plus a broken do-while condition comparing the string to itself, $string !== $string), which makes the bypass easy to reproduce for anyone who reads the patch - effectively lowering the barrier to weaponization even absent a published POC. Net: a genuine, patch-worthy stored-XSS with authenticated precondition, not an internet-wide unauthenticated emergency.

An attacker who has (or registers/obtains) an Author-role account submits a profile bio containing solidus-prefixed event-handler markup (e.g. an on* handler after a '/') or nested forbidden tags that slip past the single-pass, mis-delimited sanitizeHTML() filter. When an unauthenticated visitor, another user, or an administrator later views /author/{username}, the admin user-management view, or a comment display, the attacker's JavaScript executes in the victim's session context. No public exploit was provided, but the fix commit discloses the exact sanitizer defects, making the payload straightforward to construct.