Vvveb
Monthly
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, duplicate, or delete products belonging to other Vendors by submitting arbitrary product_id values in backend product operations. The root cause is that the products.php controller passes caller-controlled product_id values to SQL operations without consistently enforcing admin_id scoping - the fix required adding conditional admin_id filtering across six DELETE statements in both MySQL and PostgreSQL query files. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity makes it a meaningful business-logic risk for any multi-vendor Vvveb deployment.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access, modify, or delete digital assets belonging to any other Vendor by supplying arbitrary digital_asset_id values to the admin digital asset controllers. The flaw spans listing, read, edit, and delete operations across both MySQL and PostgreSQL backends, enabling cross-tenant metadata disclosure, resource link corruption, and permanent data loss. No public exploit code or CISA KEV listing exists at time of analysis, but exploitation is technically trivial for any authenticated Vendor in a multi-vendor deployment.
Vvveb CMS versions before 1.0.8.3 allow authenticated users to hijack other users' shopping carts during checkout. The checkout endpoint fails to verify cart ownership when processing a user-supplied cart_id parameter, enabling attackers to access and potentially complete purchases using another user's cart contents. This vulnerability has been patched in version 1.0.8.3.
Authenticated administrators in Vvveb CMS versions before 1.0.8.3 can access REST API tokens of other administrators through the admin/auth-token endpoint by manipulating the admin_id parameter. This authorization bypass allows lateral privilege escalation between admin accounts, potentially compromising all administrative API operations. The vulnerability requires low-privileged authenticated access and has been patched in version 1.0.8.3.
SQL injection in Vvveb CMS versions before 1.0.8.3 allows authenticated frontend users to execute arbitrary SQL queries through the order history page. The vulnerability exists in the /user/orders endpoint where order_by and direction parameters are directly concatenated into SQL queries without sanitization, enabling database compromise with low-privileged user credentials. The vendor has released version 1.0.8.3 to address this issue.
Unauthenticated reflected cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 enables attackers to execute arbitrary JavaScript in victim browsers via the public product return form. The customer_order_id parameter is reflected without sanitization in error messages when order lookups fail, allowing HTML injection. No public exploit identified at time of analysis. While CVSS 5.3 indicates moderate severity, the unauthenticated attack vector (PR:N) and low complexity (AC:L) make this readily exploitable against any site visitor, though user interaction (UI:P) is required to submit the malicious form.
Cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 allows authenticated users to inject malicious scripts that execute in victim browsers with user interaction. The CVSS 4.0 vector indicates network-based attack requiring low-privilege authentication and user interaction, with low confidentiality and integrity impact to the subsequent system. GitHub security advisory confirms the vulnerability, with patch version 1.0.8.3 available. No public exploit code identified at time of analysis, and EPSS data not available for this recently assigned CVE.
Negative quantity manipulation in Vvveb CMS versions before 1.0.8.2 allows unauthenticated remote attackers to create orders with negative totals, potentially defrauding merchants. The cart-add endpoint accepts negative quantity values that propagate through the entire order flow, creating legitimate-looking orders where the merchant appears to owe money to the customer. Fixed in version 1.0.8.2.
Stored Cross-Site Scripting in Vvveb CMS comment submission allows unauthenticated attackers to inject malicious JavaScript through the author field on public post pages. The payload persists in the database and executes in two distinct contexts when administrators or other users view the comments, enabling session hijacking, credential theft, or administrative action manipulation. No public exploit code has been identified at time of analysis, though exploitation requires only user interaction (victim viewing the malicious comment). EPSS data not available; CVSS 6.1 reflects moderate severity with cross-site scope change.
Vvveb before 1.0.8.2 exposes the application's secret cron key through an unauthenticated cron controller endpoint, allowing remote attackers to retrieve this sensitive credential and trigger scheduled tasks outside their intended execution windows. The vulnerability affects all deployments with the vulnerable cron controller accessible over the network, with CVSS 5.3 reflecting confidentiality impact from information disclosure without authentication requirements.
Unauthenticated reflected cross-site scripting (XSS) in Vvveb before 1.0.8.2 allows remote attackers to execute arbitrary JavaScript in the context of the Vvveb origin by manipulating the r query parameter and _component_ajax POST parameter in the visual editor preview renderer. The vulnerability exploits the absence of session, role, or token verification in the isEditor() gating function combined with unsanitized injection of POST body content, requiring only user interaction to trigger but affecting all versions prior to 1.0.8.2. Active exploitation status is not confirmed, but a vendor-released patch is available.
Remote code execution in Vvveb CMS versions before 1.0.8.2 allows authenticated users with media-upload permissions to execute arbitrary PHP code with web server privileges via a two-stage attack: uploading a malicious .htaccess file to map .phtml extensions to the PHP handler, then uploading a .phtml file containing PHP code. Exploitation requires only low-privileged authentication (CVSS PR:L) and no user interaction (UI:N), making post-authentication compromise straightforward. Vendor-released patch available in version 1.0.8.2 per GitHub security advisory GHSA-wwmv-4g9g-p48g and commit 54a9e846. VulnCheck advisory provides detailed technical analysis of the bypass technique.
Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote attackers. Versions prior to 1.0.8.2 ship with pre-configured phpMyAdmin credentials in docker-compose-apache.yaml, allowing direct database access without authentication. Attackers gain unrestricted read/write access to administrator password hashes, customer PII, and order data, enabling account takeover and data manipulation. CVSS 9.2 (Critical) reflects network-accessible attack with low complexity. Patch available in version 1.0.8.2 with vendor advisory confirmed by GitHub Security Advisory GHSA-g38h-mr9p-fjmf.
Vvveb before version 1.0.8.2 allows unauthenticated remote attackers to disclose sensitive server information including absolute file paths, internal class namespaces, line numbers, and source code excerpts by accessing the admin password-reset endpoint and triggering a fatal error caused by missing namespace imports. The debug exception handler renders full stack traces to unauthenticated requests, enabling reconnaissance attacks without authentication or user interaction. No active exploitation confirmed, but the vulnerability is easily discoverable and exploitable over the network.
Remote code execution in Vvveb CMS versions before 1.0.8.2 enables low-privilege authenticated users (editor, author, contributor, or site_admin roles) to escalate privileges and execute arbitrary PHP code. Attackers exploit the admin code editor's insufficient file extension validation by first uploading a malicious .htaccess file that maps arbitrary extensions to the PHP handler, then uploading PHP code disguised with that extension. Once uploaded, the PHP code executes with web server privileges when accessed via HTTP, effectively bypassing authentication and achieving full system compromise. The vulnerability requires only low-privilege access (PR:L) with no attack complexity or user interaction (AC:L/UI:N), and vendor-released patch version 1.0.8.2 is confirmed available via GitHub. No public exploit code or active exploitation (KEV) confirmed at time of analysis.
XML external entity injection in Vvveb CMS versions before 1.0.8.2 allows authenticated site_admin users to read arbitrary server files and overwrite administrator password hashes via the admin Tools/Import feature. The vulnerability resides in system/import/xml.php where LIBXML_NOENT flag enabled external entity resolution, allowing injection of file:// and php://filter protocols. Attackers with low-privilege admin accounts can escalate to full administrator access by replacing password hashes in the database. Vendor-released patch version 1.0.8.2 removes LIBXML_NOENT flag. No active exploitation confirmed by CISA KEV at time of analysis.
Remote code execution in Vvveb CMS 1.0.8 allows authenticated attackers with low privileges to upload PHP webshells disguised with .phtml extensions, bypassing file type restrictions to achieve full server compromise. The vulnerability stems from inadequate file upload validation in the media handler, enabling malicious files in publicly accessible directories. Upstream fix available via GitHub commit; EPSS data unavailable, no CISA KEV listing at time of analysis.
Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as www-data via a two-stage file upload attack. Attackers exploit a logic flaw in the media management file rename handler that fails to block .php and .htaccess extensions, enabling MIME type manipulation followed by PHP code execution. VulnCheck published an advisory and GitHub commit 6fb8eaa confirms upstream fix. No EPSS data available; no active exploitation confirmed at time of analysis.
Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's subdir parameter, which is written directly into env.php without sanitization. The vulnerability enables complete system compromise as the web server user with no authentication required. Publicly available patch exists (version 1.0.8.1) with detailed fix commit reference.
Server-Side Request Forgery in Vvveb CMS versions prior to 1.0.8.1 allows authenticated backend users to read arbitrary local files via file:// URLs or probe internal network services via http:// URLs through the oEmbedProxy action's unvalidated url parameter. The vulnerability (CWE-918) enables information disclosure from the web server's filesystem and internal network reconnaissance. Patch available in version 1.0.8.1. EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Privilege escalation in Vvveb CMS versions prior to 1.0.8.1 allows authenticated low-privileged users to inject role_id=1 into profile save requests, escalating to Super Administrator and enabling plugin upload for remote code execution. Vendor patch available in version 1.0.8.1. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided; KEV status unknown. Public disclosure via VulnCheck advisory with commit-level fix details increases likelihood of exploitation attempts.
Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript in administrator browsers by bypassing MIME type validation with a GIF89a header prepend, renaming files to .html extensions, and injecting malicious payloads that can create backdoor accounts or upload remote code execution plugins. Publicly available exploit code exists and vendor-released patch 1.0.8.1 is available. Real-world risk is moderate due to authentication requirement and required user interaction (administrator must visit malicious page), but privilege escalation path to RCE via plugin upload makes this a critical persistence vector.
Path traversal in givanz Vvveb up to 1.0.7.3 allows authenticated remote attackers to manipulate the File argument in the Code Editor's sanitizeFileName function, enabling unauthorized file system access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS score of 0.05% suggests limited real-world exploitation despite the availability of proof-of-concept.
SQL injection in Vvveb up to version 1.0.7.3 allows authenticated high-privileged remote attackers to execute arbitrary SQL queries through the Raw SQL Handler import function in admin/controller/tools/import.php. The vulnerability requires administrative credentials and has been publicly disclosed with exploit code available, though EPSS modeling indicates low real-world exploitation probability at 0.04%.
A weakness has been identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A weakness has been identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5.php?module=settings/post-types of the component Add Type Handler. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability was found in givanz Vvveb 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 16.9%.
A vulnerability was detected in givanz Vvveb 1.0.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, duplicate, or delete products belonging to other Vendors by submitting arbitrary product_id values in backend product operations. The root cause is that the products.php controller passes caller-controlled product_id values to SQL operations without consistently enforcing admin_id scoping - the fix required adding conditional admin_id filtering across six DELETE statements in both MySQL and PostgreSQL query files. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity makes it a meaningful business-logic risk for any multi-vendor Vvveb deployment.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access, modify, or delete digital assets belonging to any other Vendor by supplying arbitrary digital_asset_id values to the admin digital asset controllers. The flaw spans listing, read, edit, and delete operations across both MySQL and PostgreSQL backends, enabling cross-tenant metadata disclosure, resource link corruption, and permanent data loss. No public exploit code or CISA KEV listing exists at time of analysis, but exploitation is technically trivial for any authenticated Vendor in a multi-vendor deployment.
Vvveb CMS versions before 1.0.8.3 allow authenticated users to hijack other users' shopping carts during checkout. The checkout endpoint fails to verify cart ownership when processing a user-supplied cart_id parameter, enabling attackers to access and potentially complete purchases using another user's cart contents. This vulnerability has been patched in version 1.0.8.3.
Authenticated administrators in Vvveb CMS versions before 1.0.8.3 can access REST API tokens of other administrators through the admin/auth-token endpoint by manipulating the admin_id parameter. This authorization bypass allows lateral privilege escalation between admin accounts, potentially compromising all administrative API operations. The vulnerability requires low-privileged authenticated access and has been patched in version 1.0.8.3.
SQL injection in Vvveb CMS versions before 1.0.8.3 allows authenticated frontend users to execute arbitrary SQL queries through the order history page. The vulnerability exists in the /user/orders endpoint where order_by and direction parameters are directly concatenated into SQL queries without sanitization, enabling database compromise with low-privileged user credentials. The vendor has released version 1.0.8.3 to address this issue.
Unauthenticated reflected cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 enables attackers to execute arbitrary JavaScript in victim browsers via the public product return form. The customer_order_id parameter is reflected without sanitization in error messages when order lookups fail, allowing HTML injection. No public exploit identified at time of analysis. While CVSS 5.3 indicates moderate severity, the unauthenticated attack vector (PR:N) and low complexity (AC:L) make this readily exploitable against any site visitor, though user interaction (UI:P) is required to submit the malicious form.
Cross-site scripting (XSS) in Vvveb CMS versions prior to 1.0.8.3 allows authenticated users to inject malicious scripts that execute in victim browsers with user interaction. The CVSS 4.0 vector indicates network-based attack requiring low-privilege authentication and user interaction, with low confidentiality and integrity impact to the subsequent system. GitHub security advisory confirms the vulnerability, with patch version 1.0.8.3 available. No public exploit code identified at time of analysis, and EPSS data not available for this recently assigned CVE.
Negative quantity manipulation in Vvveb CMS versions before 1.0.8.2 allows unauthenticated remote attackers to create orders with negative totals, potentially defrauding merchants. The cart-add endpoint accepts negative quantity values that propagate through the entire order flow, creating legitimate-looking orders where the merchant appears to owe money to the customer. Fixed in version 1.0.8.2.
Stored Cross-Site Scripting in Vvveb CMS comment submission allows unauthenticated attackers to inject malicious JavaScript through the author field on public post pages. The payload persists in the database and executes in two distinct contexts when administrators or other users view the comments, enabling session hijacking, credential theft, or administrative action manipulation. No public exploit code has been identified at time of analysis, though exploitation requires only user interaction (victim viewing the malicious comment). EPSS data not available; CVSS 6.1 reflects moderate severity with cross-site scope change.
Vvveb before 1.0.8.2 exposes the application's secret cron key through an unauthenticated cron controller endpoint, allowing remote attackers to retrieve this sensitive credential and trigger scheduled tasks outside their intended execution windows. The vulnerability affects all deployments with the vulnerable cron controller accessible over the network, with CVSS 5.3 reflecting confidentiality impact from information disclosure without authentication requirements.
Unauthenticated reflected cross-site scripting (XSS) in Vvveb before 1.0.8.2 allows remote attackers to execute arbitrary JavaScript in the context of the Vvveb origin by manipulating the r query parameter and _component_ajax POST parameter in the visual editor preview renderer. The vulnerability exploits the absence of session, role, or token verification in the isEditor() gating function combined with unsanitized injection of POST body content, requiring only user interaction to trigger but affecting all versions prior to 1.0.8.2. Active exploitation status is not confirmed, but a vendor-released patch is available.
Remote code execution in Vvveb CMS versions before 1.0.8.2 allows authenticated users with media-upload permissions to execute arbitrary PHP code with web server privileges via a two-stage attack: uploading a malicious .htaccess file to map .phtml extensions to the PHP handler, then uploading a .phtml file containing PHP code. Exploitation requires only low-privileged authentication (CVSS PR:L) and no user interaction (UI:N), making post-authentication compromise straightforward. Vendor-released patch available in version 1.0.8.2 per GitHub security advisory GHSA-wwmv-4g9g-p48g and commit 54a9e846. VulnCheck advisory provides detailed technical analysis of the bypass technique.
Hard-coded credentials in Vvveb's Docker deployment expose the entire application database to unauthenticated remote attackers. Versions prior to 1.0.8.2 ship with pre-configured phpMyAdmin credentials in docker-compose-apache.yaml, allowing direct database access without authentication. Attackers gain unrestricted read/write access to administrator password hashes, customer PII, and order data, enabling account takeover and data manipulation. CVSS 9.2 (Critical) reflects network-accessible attack with low complexity. Patch available in version 1.0.8.2 with vendor advisory confirmed by GitHub Security Advisory GHSA-g38h-mr9p-fjmf.
Vvveb before version 1.0.8.2 allows unauthenticated remote attackers to disclose sensitive server information including absolute file paths, internal class namespaces, line numbers, and source code excerpts by accessing the admin password-reset endpoint and triggering a fatal error caused by missing namespace imports. The debug exception handler renders full stack traces to unauthenticated requests, enabling reconnaissance attacks without authentication or user interaction. No active exploitation confirmed, but the vulnerability is easily discoverable and exploitable over the network.
Remote code execution in Vvveb CMS versions before 1.0.8.2 enables low-privilege authenticated users (editor, author, contributor, or site_admin roles) to escalate privileges and execute arbitrary PHP code. Attackers exploit the admin code editor's insufficient file extension validation by first uploading a malicious .htaccess file that maps arbitrary extensions to the PHP handler, then uploading PHP code disguised with that extension. Once uploaded, the PHP code executes with web server privileges when accessed via HTTP, effectively bypassing authentication and achieving full system compromise. The vulnerability requires only low-privilege access (PR:L) with no attack complexity or user interaction (AC:L/UI:N), and vendor-released patch version 1.0.8.2 is confirmed available via GitHub. No public exploit code or active exploitation (KEV) confirmed at time of analysis.
XML external entity injection in Vvveb CMS versions before 1.0.8.2 allows authenticated site_admin users to read arbitrary server files and overwrite administrator password hashes via the admin Tools/Import feature. The vulnerability resides in system/import/xml.php where LIBXML_NOENT flag enabled external entity resolution, allowing injection of file:// and php://filter protocols. Attackers with low-privilege admin accounts can escalate to full administrator access by replacing password hashes in the database. Vendor-released patch version 1.0.8.2 removes LIBXML_NOENT flag. No active exploitation confirmed by CISA KEV at time of analysis.
Remote code execution in Vvveb CMS 1.0.8 allows authenticated attackers with low privileges to upload PHP webshells disguised with .phtml extensions, bypassing file type restrictions to achieve full server compromise. The vulnerability stems from inadequate file upload validation in the media handler, enabling malicious files in publicly accessible directories. Upstream fix available via GitHub commit; EPSS data unavailable, no CISA KEV listing at time of analysis.
Remote code execution in Vvveb CMS v1.0.8 allows authenticated administrators to execute arbitrary system commands as www-data via a two-stage file upload attack. Attackers exploit a logic flaw in the media management file rename handler that fails to block .php and .htaccess extensions, enabling MIME type manipulation followed by PHP code execution. VulnCheck published an advisory and GitHub commit 6fb8eaa confirms upstream fix. No EPSS data available; no active exploitation confirmed at time of analysis.
Remote code execution in Vvveb CMS versions prior to 1.0.8.1 allows unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's subdir parameter, which is written directly into env.php without sanitization. The vulnerability enables complete system compromise as the web server user with no authentication required. Publicly available patch exists (version 1.0.8.1) with detailed fix commit reference.
Server-Side Request Forgery in Vvveb CMS versions prior to 1.0.8.1 allows authenticated backend users to read arbitrary local files via file:// URLs or probe internal network services via http:// URLs through the oEmbedProxy action's unvalidated url parameter. The vulnerability (CWE-918) enables information disclosure from the web server's filesystem and internal network reconnaissance. Patch available in version 1.0.8.1. EPSS data not provided; no CISA KEV listing indicates no confirmed widespread exploitation at time of analysis.
Privilege escalation in Vvveb CMS versions prior to 1.0.8.1 allows authenticated low-privileged users to inject role_id=1 into profile save requests, escalating to Super Administrator and enabling plugin upload for remote code execution. Vendor patch available in version 1.0.8.1. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. EPSS data not provided; KEV status unknown. Public disclosure via VulnCheck advisory with commit-level fix details increases likelihood of exploitation attempts.
Stored cross-site scripting in Vvveb prior to 1.0.8.1 allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript in administrator browsers by bypassing MIME type validation with a GIF89a header prepend, renaming files to .html extensions, and injecting malicious payloads that can create backdoor accounts or upload remote code execution plugins. Publicly available exploit code exists and vendor-released patch 1.0.8.1 is available. Real-world risk is moderate due to authentication requirement and required user interaction (administrator must visit malicious page), but privilege escalation path to RCE via plugin upload makes this a critical persistence vector.
Path traversal in givanz Vvveb up to 1.0.7.3 allows authenticated remote attackers to manipulate the File argument in the Code Editor's sanitizeFileName function, enabling unauthorized file system access with low confidentiality, integrity, and availability impact. Publicly available exploit code exists, though EPSS score of 0.05% suggests limited real-world exploitation despite the availability of proof-of-concept.
SQL injection in Vvveb up to version 1.0.7.3 allows authenticated high-privileged remote attackers to execute arbitrary SQL queries through the Raw SQL Handler import function in admin/controller/tools/import.php. The vulnerability requires administrative credentials and has been publicly disclosed with exploit code available, though EPSS modeling indicates low real-world exploitation probability at 0.04%.
A weakness has been identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A weakness has been identified in givanz Vvveb up to 1.0.7.2. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5.php?module=settings/post-types of the component Add Type Handler. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability was found in givanz Vvveb 1.0.5. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 16.9%.
A vulnerability was detected in givanz Vvveb 1.0.6.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.