Search
Find a vulnerability
Search criteria
112 vulnerabilities by givanz
CVE-2026-55232 (GCVE-0-2026-55232)
Vulnerability from nvd – Published: 2026-10-01 18:43 – Updated: 2026-10-01 18:43
VLAI
EPSS
VEX
Title
Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
Severity
7.6 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/e27d1ef097… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb\u0027s SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:43:19.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-r6g4-5m3x-xrqj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-r6g4-5m3x-xrqj"
},
{
"name": "https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-r6g4-5m3x-xrqj",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55232",
"datePublished": "2026-10-01T18:43:19.102Z",
"dateReserved": "2026-06-16T16:44:00.623Z",
"dateUpdated": "2026-10-01T18:43:19.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55231 (GCVE-0-2026-55231)
Vulnerability from nvd – Published: 2026-10-01 18:42 – Updated: 2026-10-01 18:59
VLAI
EPSS
VEX
Title
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role site_admin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6.
Severity
7.2 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:59 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55231",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:59:22.893518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:59:51.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role site_admin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:42:39.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-327v-4f9p-5qxq",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55231",
"datePublished": "2026-10-01T18:42:39.182Z",
"dateReserved": "2026-06-16T16:44:00.623Z",
"dateUpdated": "2026-10-01T18:59:51.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55230 (GCVE-0-2026-55230)
Vulnerability from nvd – Published: 2026-10-01 18:42 – Updated: 2026-10-01 19:23
VLAI
EPSS
VEX
Title
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.
Severity
8.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55230",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:22:58.340870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:23:19.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb\u0027s HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:42:50.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-97xr-82vc-wj2v",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55230",
"datePublished": "2026-10-01T18:42:50.082Z",
"dateReserved": "2026-06-16T16:16:32.628Z",
"dateUpdated": "2026-10-01T19:23:19.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54613 (GCVE-0-2026-54613)
Vulnerability from nvd – Published: 2026-09-17 21:45 – Updated: 2026-09-22 01:55
VLAI
EPSS
VEX
Title
Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 01:55 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/1d76ad5240… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T01:55:03.952801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T01:55:30.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:45:32.239Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-gjxp-vrcw-69v8",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54613",
"datePublished": "2026-09-17T21:45:32.239Z",
"dateReserved": "2026-06-15T19:45:23.540Z",
"dateUpdated": "2026-09-22T01:55:30.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54612 (GCVE-0-2026-54612)
Vulnerability from nvd – Published: 2026-09-17 21:46 – Updated: 2026-09-18 20:04
VLAI
EPSS
VEX
Title
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:04 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/c8fef41ad8… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:04:45.650590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:04:55.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor\u0026action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:46:27.346Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv"
},
{
"name": "https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-c3v9-3xrq-pvqv",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54612",
"datePublished": "2026-09-17T21:46:27.346Z",
"dateReserved": "2026-06-15T19:45:23.540Z",
"dateUpdated": "2026-09-18T20:04:55.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54507 (GCVE-0-2026-54507)
Vulnerability from nvd – Published: 2026-09-17 21:44 – Updated: 2026-09-18 14:43
VLAI
EPSS
VEX
Title
Vvveb oEmbedProxy vulnerable to server-side request forgery
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:36 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/bd280f5ce1… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:36:53.498947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:43:10.025Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor\u0026action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:44:47.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-xxp7-59p2-4jr8",
"discovery": "UNKNOWN"
},
"title": "Vvveb oEmbedProxy vulnerable to server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54507",
"datePublished": "2026-09-17T21:44:47.699Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-09-18T14:43:10.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54506 (GCVE-0-2026-54506)
Vulnerability from nvd – Published: 2026-09-17 21:47 – Updated: 2026-09-23 19:09
VLAI
EPSS
VEX
Title
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:09 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/20a01ef085… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54506",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:09:15.788977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:09:21.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-185",
"description": "CWE-185: Incorrect Regular Expression",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:47:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr"
},
{
"name": "https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-5cg7-phhv-4qjr",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54506",
"datePublished": "2026-09-17T21:47:20.530Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-09-23T19:09:21.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49228 (GCVE-0-2026-49228)
Vulnerability from nvd – Published: 2026-08-18 16:15 – Updated: 2026-08-18 17:59
VLAI
EPSS
VEX
Title
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:59 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/6db5257ce9… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:59:21.593656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:59:27.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:15:45.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9"
},
{
"name": "https://github.com/givanz/Vvveb/commit/6db5257ce9fec0d570da63a06f54b98e857603cc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/6db5257ce9fec0d570da63a06f54b98e857603cc"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-j5jv-wvpg-gfh9",
"discovery": "UNKNOWN"
},
"title": "Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49228",
"datePublished": "2026-08-18T16:15:45.907Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:59:27.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49225 (GCVE-0-2026-49225)
Vulnerability from nvd – Published: 2026-08-18 16:16 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:28 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/e7413a29dc… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:28:25.880054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:07.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor\u0027s live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:16:24.999Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gmrp-ccwf-xggq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gmrp-ccwf-xggq"
},
{
"name": "https://github.com/givanz/Vvveb/commit/e7413a29dcf1ccd04bbc44ebe26f20979223de14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/e7413a29dcf1ccd04bbc44ebe26f20979223de14"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-gmrp-ccwf-xggq",
"discovery": "UNKNOWN"
},
"title": "Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors\u0027 product revisions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49225",
"datePublished": "2026-08-18T16:16:24.999Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:46:07.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49224 (GCVE-0-2026-49224)
Vulnerability from nvd – Published: 2026-08-18 16:17 – Updated: 2026-08-19 14:49
VLAI
EPSS
VEX
Title
Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/cbedd3754b… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:49:27.594189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:49:51.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author\u0027s live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:17:30.832Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf"
},
{
"name": "https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-88w5-4x93-48rf",
"discovery": "UNKNOWN"
},
"title": "Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors\u0027 post revisions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49224",
"datePublished": "2026-08-18T16:17:30.832Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-19T14:49:51.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49223 (GCVE-0-2026-49223)
Vulnerability from nvd – Published: 2026-08-18 16:18 – Updated: 2026-08-18 19:08
VLAI
EPSS
VEX
Title
Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 19:08 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/3d5c15dcf4… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49223",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T19:08:11.438646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:08:27.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor\u0027s products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:18:09.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc"
},
{
"name": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-cj37-c5m2-3jmc",
"discovery": "UNKNOWN"
},
"title": "Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49223",
"datePublished": "2026-08-18T16:18:09.914Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T19:08:27.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49222 (GCVE-0-2026-49222)
Vulnerability from nvd – Published: 2026-08-18 16:17 – Updated: 2026-08-18 17:47
VLAI
EPSS
VEX
Title
Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:39 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/1f2b117c14… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:39:54.526746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:47:01.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor\u0027s products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q\u0026A visibility and integrity. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:17:00.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-cjhq-xqq3-6xv8",
"discovery": "UNKNOWN"
},
"title": "Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49222",
"datePublished": "2026-08-18T16:17:00.524Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:47:01.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49227 (GCVE-0-2026-49227)
Vulnerability from nvd – Published: 2026-08-18 16:00 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/70ec3c69f5… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:19:11.298262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:14.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author\u0027s posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:00:49.281Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-26pw-fgm8-2hcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-26pw-fgm8-2hcf"
},
{
"name": "https://github.com/givanz/Vvveb/commit/70ec3c69f56d56938d96f9bd2c71daf2a7cd787f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/70ec3c69f56d56938d96f9bd2c71daf2a7cd787f"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-26pw-fgm8-2hcf",
"discovery": "UNKNOWN"
},
"title": "Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors\u0027 posts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49227",
"datePublished": "2026-08-18T16:00:49.281Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:46:14.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49226 (GCVE-0-2026-49226)
Vulnerability from nvd – Published: 2026-08-18 16:01 – Updated: 2026-08-19 14:47
VLAI
EPSS
VEX
Title
Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:46 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/0ce6ba6baf… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49226",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:46:23.198340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:47:01.636Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:01:30.966Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6"
},
{
"name": "https://github.com/givanz/Vvveb/commit/0ce6ba6baf5901aaffa993857ee71c43481a5353",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/0ce6ba6baf5901aaffa993857ee71c43481a5353"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-xxx7-8f3v-g9p6",
"discovery": "UNKNOWN"
},
"title": "Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors\u0027 posts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49226",
"datePublished": "2026-08-18T16:01:30.966Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-19T14:47:01.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49221 (GCVE-0-2026-49221)
Vulnerability from nvd – Published: 2026-08-18 15:57 – Updated: 2026-08-18 19:00
VLAI
EPSS
VEX
Title
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 19:00 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/0463ae60cd… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49221",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T19:00:20.648642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:00:38.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor\u0027s products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:57:45.748Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j"
},
{
"name": "https://github.com/givanz/Vvveb/commit/0463ae60cda5085238b380bf53780ccf4be5dd50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/0463ae60cda5085238b380bf53780ccf4be5dd50"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-chpc-xj4m-9g3j",
"discovery": "UNKNOWN"
},
"title": "Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors\u0027 digital assets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49221",
"datePublished": "2026-08-18T15:57:45.748Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T19:00:38.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55232 (GCVE-0-2026-55232)
Vulnerability from cvelistv5 – Published: 2026-10-01 18:43 – Updated: 2026-10-01 18:43
VLAI
EPSS
VEX
Title
Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6.
Severity
7.6 (High)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/e27d1ef097… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb\u0027s SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed proxy fetches an attacker-supplied URL server side and reflects a response body, so an authenticated admin-panel user (default role site_admin or higher) can read internal-only services and cloud metadata, including IAM credentials, using an IPv6 literal or a domain that carries only an AAAA record. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:43:19.102Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-r6g4-5m3x-xrqj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-r6g4-5m3x-xrqj"
},
{
"name": "https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/e27d1ef097a8502c33f8cc94271c948407c5dce3"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-r6g4-5m3x-xrqj",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55232",
"datePublished": "2026-10-01T18:43:19.102Z",
"dateReserved": "2026-06-16T16:44:00.623Z",
"dateUpdated": "2026-10-01T18:43:19.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55230 (GCVE-0-2026-55230)
Vulnerability from cvelistv5 – Published: 2026-10-01 18:42 – Updated: 2026-10-01 19:23
VLAI
EPSS
VEX
Title
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.
Severity
8.7 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:22 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55230",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:22:58.340870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:23:19.200Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb\u0027s HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:42:50.082Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-97xr-82vc-wj2v"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-97xr-82vc-wj2v",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55230",
"datePublished": "2026-10-01T18:42:50.082Z",
"dateReserved": "2026-06-16T16:16:32.628Z",
"dateUpdated": "2026-10-01T19:23:19.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-55231 (GCVE-0-2026-55231)
Vulnerability from cvelistv5 – Published: 2026-10-01 18:42 – Updated: 2026-10-01 18:59
VLAI
EPSS
VEX
Title
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role site_admin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6.
Severity
7.2 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:59 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.6 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-55231",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:59:22.893518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:59:51.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access (default role site_admin or higher) read and delete arbitrary files on a server. An attacker can recover database credentials from config/db.php, read host files such as /etc/passwd, and delete config/db.php to push a site back into install mode for a full takeover. This issue has been patched in version 1.0.8.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:42:39.182Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-327v-4f9p-5qxq"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.6"
}
],
"source": {
"advisory": "GHSA-327v-4f9p-5qxq",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-55231",
"datePublished": "2026-10-01T18:42:39.182Z",
"dateReserved": "2026-06-16T16:44:00.623Z",
"dateUpdated": "2026-10-01T18:59:51.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54506 (GCVE-0-2026-54506)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:47 – Updated: 2026-09-23 19:09
VLAI
EPSS
VEX
Title
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:09 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/20a01ef085… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54506",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:09:15.788977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:09:21.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-185",
"description": "CWE-185: Incorrect Regular Expression",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:47:20.530Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-5cg7-phhv-4qjr"
},
{
"name": "https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/20a01ef08559ffdc97205edeecde86c8ea27e567"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-5cg7-phhv-4qjr",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54506",
"datePublished": "2026-09-17T21:47:20.530Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-09-23T19:09:21.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54612 (GCVE-0-2026-54612)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:46 – Updated: 2026-09-18 20:04
VLAI
EPSS
VEX
Title
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor&action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:04 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/c8fef41ad8… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54612",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:04:45.650590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:04:55.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.0.0, \u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin/controller/editor/global-trait.php concatenates the attacker-controlled file portion of data-v-save-global to the active theme directory before loadHTMLFile() and file_put_contents() operate on it. An authenticated user with the default Editor role and editor/* permission can submit crafted HTML to module=editor/editor\u0026action=save and traverse to an existing writable PHP file outside the theme directory. If the target is web-accessible, editor-controlled PHP content executes in the web server context; a shipped public/vadmin/index.php entrypoint can be used as an execution trampoline rather than requiring a test-only file. This can permit persistent webshell placement and compromise application confidentiality, integrity, and availability. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:46:27.346Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-c3v9-3xrq-pvqv"
},
{
"name": "https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/c8fef41ad8651d348050c513451755ab8882b97e"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-c3v9-3xrq-pvqv",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54612",
"datePublished": "2026-09-17T21:46:27.346Z",
"dateReserved": "2026-06-15T19:45:23.540Z",
"dateUpdated": "2026-09-18T20:04:55.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54613 (GCVE-0-2026-54613)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:45 – Updated: 2026-09-22 01:55
VLAI
EPSS
VEX
Title
Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 01:55 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/1d76ad5240… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54613",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T01:55:03.952801Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T01:55:30.837Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/editor/revisions.php returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root. A valid admin session and CSRF token are required, the read is limited to .html files in backup directories, and deletion additionally requires filesystem write permission. This can disclose sensitive exported site content or remove backup data. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:45:32.239Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gjxp-vrcw-69v8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/1d76ad52402beeed623a7e386c6796126689a746"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-gjxp-vrcw-69v8",
"discovery": "UNKNOWN"
},
"title": "Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54613",
"datePublished": "2026-09-17T21:45:32.239Z",
"dateReserved": "2026-06-15T19:45:23.540Z",
"dateUpdated": "2026-09-22T01:55:30.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-54507 (GCVE-0-2026-54507)
Vulnerability from cvelistv5 – Published: 2026-09-17 21:44 – Updated: 2026-09-18 14:43
VLAI
EPSS
VEX
Title
Vvveb oEmbedProxy vulnerable to server-side request forgery
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 14:36 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/bd280f5ce1… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-54507",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T14:36:53.498947Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T14:43:10.025Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor\u0026action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T21:44:47.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.5"
}
],
"source": {
"advisory": "GHSA-xxp7-59p2-4jr8",
"discovery": "UNKNOWN"
},
"title": "Vvveb oEmbedProxy vulnerable to server-side request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-54507",
"datePublished": "2026-09-17T21:44:47.699Z",
"dateReserved": "2026-06-15T18:01:15.512Z",
"dateUpdated": "2026-09-18T14:43:10.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49223 (GCVE-0-2026-49223)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:18 – Updated: 2026-08-18 19:08
VLAI
EPSS
VEX
Title
Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 19:08 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/3d5c15dcf4… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49223",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T19:08:11.438646Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:08:27.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor\u0027s products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:18:09.914Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc"
},
{
"name": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-cj37-c5m2-3jmc",
"discovery": "UNKNOWN"
},
"title": "Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49223",
"datePublished": "2026-08-18T16:18:09.914Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T19:08:27.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49224 (GCVE-0-2026-49224)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:17 – Updated: 2026-08-19 14:49
VLAI
EPSS
VEX
Title
Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author's live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:49 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/cbedd3754b… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49224",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:49:27.594189Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:49:51.409Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author. The admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trust caller-controlled post_id, language_id, and created_at values without consistently applying the current admin_id to revision lists, reads, restores, and deletes. An attacker can read historic post content, restore a revision over another Author\u0027s live post content, or delete revision records, exposing drafts, corrupting published content, and removing audit history. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:17:30.832Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-88w5-4x93-48rf"
},
{
"name": "https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/cbedd3754bccf8b7584f02ab301291f12e888b7e"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-88w5-4x93-48rf",
"discovery": "UNKNOWN"
},
"title": "Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors\u0027 post revisions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49224",
"datePublished": "2026-08-18T16:17:30.832Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-19T14:49:51.409Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49222 (GCVE-0-2026-49222)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:17 – Updated: 2026-08-18 17:47
VLAI
EPSS
VEX
Title
Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q&A visibility and integrity. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:39 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/1f2b117c14… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49222",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:39:54.526746Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:47:01.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor\u0027s products. The admin/sql/sqlite/product_question.sql queries accept a caller-controlled product_question_id and do not verify product_question.product_id against product.admin_id for the current admin_id. An attacker can read pending question content and moderation data, change question status, edit question content, or delete questions, manipulating product Q\u0026A visibility and integrity. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:17:00.524Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cjhq-xqq3-6xv8"
},
{
"name": "https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/1f2b117c1460818c9306a78f22c12f0b713886df"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-cjhq-xqq3-6xv8",
"discovery": "UNKNOWN"
},
"title": "Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49222",
"datePublished": "2026-08-18T16:17:00.524Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:47:01.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49225 (GCVE-0-2026-49225)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:16 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:28 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/e7413a29dc… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:28:25.880054Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:07.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor\u0027s live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:16:24.999Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gmrp-ccwf-xggq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-gmrp-ccwf-xggq"
},
{
"name": "https://github.com/givanz/Vvveb/commit/e7413a29dcf1ccd04bbc44ebe26f20979223de14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/e7413a29dcf1ccd04bbc44ebe26f20979223de14"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-gmrp-ccwf-xggq",
"discovery": "UNKNOWN"
},
"title": "Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors\u0027 product revisions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49225",
"datePublished": "2026-08-18T16:16:24.999Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:46:07.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49228 (GCVE-0-2026-49228)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:15 – Updated: 2026-08-18 17:59
VLAI
EPSS
VEX
Title
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:59 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/6db5257ce9… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:59:21.593656Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:59:27.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a caller-controlled product_id for duplicate and delete actions, and admin/sql/sqlite/product.sql loads and mutates products without consistently applying the current admin_id when view_other_products or edit_other_products is absent. An attacker can read product details, duplicate products, or delete products and related catalog data, exposing commercial information and causing unauthorized copies, catalog pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:15:45.907Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-j5jv-wvpg-gfh9"
},
{
"name": "https://github.com/givanz/Vvveb/commit/6db5257ce9fec0d570da63a06f54b98e857603cc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/6db5257ce9fec0d570da63a06f54b98e857603cc"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-j5jv-wvpg-gfh9",
"discovery": "UNKNOWN"
},
"title": "Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors\u0027 products"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49228",
"datePublished": "2026-08-18T16:15:45.907Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:59:27.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49226 (GCVE-0-2026-49226)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:01 – Updated: 2026-08-19 14:47
VLAI
EPSS
VEX
Title
Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4.
Severity
8.3 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 14:46 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/0ce6ba6baf… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49226",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T14:46:23.198340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T14:47:01.636Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author. The admin/controller/content/posts.php controller permits filter[admin_id] to replace the server-selected admin_id restriction and accepts a caller-controlled post_id for duplicate and delete actions, while admin/sql/sqlite/post.sql does not consistently enforce post.admin_id. An attacker can view post metadata, discover post identifiers, duplicate posts, or delete posts and related content, exposing private drafts and causing content pollution, data loss, or business disruption. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:01:30.966Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-xxx7-8f3v-g9p6"
},
{
"name": "https://github.com/givanz/Vvveb/commit/0ce6ba6baf5901aaffa993857ee71c43481a5353",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/0ce6ba6baf5901aaffa993857ee71c43481a5353"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-xxx7-8f3v-g9p6",
"discovery": "UNKNOWN"
},
"title": "Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors\u0027 posts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49226",
"datePublished": "2026-08-18T16:01:30.966Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-19T14:47:01.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49227 (GCVE-0-2026-49227)
Vulnerability from cvelistv5 – Published: 2026-08-18 16:00 – Updated: 2026-08-18 17:46
VLAI
EPSS
VEX
Title
Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 17:19 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/70ec3c69f5… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T17:19:11.298262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T17:46:14.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author\u0027s posts. The admin/controller/content/comment.php and admin/controller/content/comments.php controllers and the admin/sql/sqlite/comment.sql queries accept a caller-controlled comment_id without verifying comment.post_id against post.admin_id for the current admin_id. An attacker can read pending comment content and commenter email addresses, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T16:00:49.281Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-26pw-fgm8-2hcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-26pw-fgm8-2hcf"
},
{
"name": "https://github.com/givanz/Vvveb/commit/70ec3c69f56d56938d96f9bd2c71daf2a7cd787f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/70ec3c69f56d56938d96f9bd2c71daf2a7cd787f"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-26pw-fgm8-2hcf",
"discovery": "UNKNOWN"
},
"title": "Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors\u0027 posts"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49227",
"datePublished": "2026-08-18T16:00:49.281Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T17:46:14.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49221 (GCVE-0-2026-49221)
Vulnerability from cvelistv5 – Published: 2026-08-18 15:57 – Updated: 2026-08-18 19:00
VLAI
EPSS
VEX
Title
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
Summary
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4.
Severity
8.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-18 19:00 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/givanz/Vvveb/security/advisori… | x_refsource_CONFIRM |
| https://github.com/givanz/Vvveb/commit/0463ae60cd… | x_refsource_MISC |
| https://github.com/givanz/Vvveb/releases/tag/1.0.8.4 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49221",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-18T19:00:20.648642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T19:00:38.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Vvveb",
"vendor": "givanz",
"versions": [
{
"status": "affected",
"version": "\u003c 1.0.8.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor\u0027s products. The admin/controller/product/digital-asset.php and admin/controller/product/digital-assets.php controllers and the admin/sql/sqlite/digital_asset.sql data queries use a caller-controlled digital_asset_id without consistently enforcing the current admin_id ownership boundary. An attacker can list assets, read asset names and file metadata, edit asset metadata, or delete asset records, which can disclose private product metadata, corrupt resource links, and cause data loss. This issue is fixed in version 1.0.8.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-18T15:57:45.748Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-chpc-xj4m-9g3j"
},
{
"name": "https://github.com/givanz/Vvveb/commit/0463ae60cda5085238b380bf53780ccf4be5dd50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/commit/0463ae60cda5085238b380bf53780ccf4be5dd50"
},
{
"name": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4"
}
],
"source": {
"advisory": "GHSA-chpc-xj4m-9g3j",
"discovery": "UNKNOWN"
},
"title": "Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors\u0027 digital assets"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49221",
"datePublished": "2026-08-18T15:57:45.748Z",
"dateReserved": "2026-05-28T03:42:34.341Z",
"dateUpdated": "2026-08-18T19:00:38.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}