Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 53

Export CSV
CVE-2026-126323

Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126369

Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass

Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript&colon; entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126370

Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save

Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP by saving .sql files through the admin code editor. Attackers can bypass extension and content deny-lists with an @IF macro payload that compiles into executable PHP when the model loads, running OS commands as the web user.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126371

Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126372

Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code

Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126373

Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions

Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets low-privileged Authors read other authors' revisions. Attackers can supply a post_id, language_id, and created_at timestamp to retrieve private unpublished drafts, because the revision() action lacks the admin_id ownership restriction.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126374

Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys

Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126375

Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait

Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upload requests to product/digital-asset with another vendor's filename to break downloads or substitute malicious content.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126376

Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets

Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() on posts or products, or enumerate every vendor's digital-asset metadata.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126377

Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()

Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison to validate MD5 cookie hashes. Unauthenticated attackers can brute-force cookie values until the server's MD5 computation yields a 0e magic hash, then forge persistent cookies for account takeover.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126378

Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass

Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126379

Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding

Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-126380

Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-6257

Vvveb CMS < v1.0.8.2 Remote Code Execution via Media Management

Vvveb CMS before 1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Vvveb
Products
Vvveb
CVE-2026-41938

Vvveb < 1.0.8.2 RCE via Media Upload Handler

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and execute the uploaded payload through a subsequent unauthenticated HTTP GET request to the uploaded file, resulting in remote code execution with web server privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-41937

Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-41936

Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb before version 1.0.8.2 contains an XML external entity (XXE) injection vulnerability in the admin Tools/Import feature that allows authenticated site_admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to inject file:// or php://filter entity references that are resolved and persisted into the application database, enabling arbitrary file disclosure and administrator password hash overwriting for privilege escalation.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-41935

Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-41934

Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code through insufficient file extension restrictions, with the uploaded payload then executable via subsequent unauthenticated HTTP requests. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then upload PHP code with that extension to achieve unauthenticated remote code execution when the file is accessed via HTTP.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb
CVE-2026-41933

Vvveb < 1.0.8.3 Directory Listing Information Disclosure

Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. Attackers can access directories such as admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Givanz Vvveb
Products
Vvveb Vvveb