givanz Vvveb
55 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-112905 | < 1.0.8.7 | Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft | CRITICAL 9.0 | |||
| CVE-2026-110799 | < 1.0.8.7 | Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover | CRITICAL 9.8 | |||
| CVE-2026-112904 | < aa29cb013e5037d75f6780741bac6b69b9d403a2 | Vvveb: Path Traversal in nextRestore() and nextBackup() | HIGH 8.7 | 0.5 % | ||
| CVE-2026-55232 | < 1.0.8.6 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy | HIGH 7.6 | 0.4 % | ||
| CVE-2026-55230 | < 1.0.8.6 | Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character | HIGH 8.7 | 0.3 % | ||
| CVE-2026-55231 | < 1.0.8.6 | Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools | HIGH 7.2 | 0.5 % | ||
| CVE-2026-54506 | < 1.0.8.5 | Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field | HIGH 7.6 | 0.4 % | ||
| CVE-2026-54612 | >= 1.0.0, < 1.0.8.5 | Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global | HIGH 8.8 | 0.8 % | ||
| CVE-2026-54613 | < 1.0.8.5 | Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-54507 | < 1.0.8.5 | Vvveb oEmbedProxy vulnerable to server-side request forgery | HIGH 8.4 | 0.4 % | ||
| CVE-2026-49223 | < 1.0.8.4 | Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products | HIGH 7.6 | 0.4 % | ||
| CVE-2026-49224 | < 1.0.8.4 | Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions | HIGH 8.3 | 0.5 % | ||
| CVE-2026-49222 | < 1.0.8.4 | Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products | HIGH 7.6 | 0.4 % | ||
| CVE-2026-49225 | < 1.0.8.4 | Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions | HIGH 8.3 | 0.5 % | ||
| CVE-2026-49228 | < 1.0.8.4 | Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products | HIGH 8.8 | 0.6 % | ||
| CVE-2026-49226 | < 1.0.8.4 | Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts | HIGH 8.3 | 0.5 % | ||
| CVE-2026-49227 | < 1.0.8.4 | Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts | HIGH 7.6 | 0.4 % | ||
| CVE-2026-49221 | < 1.0.8.4 | Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets | HIGH 8.8 | 0.6 % | ||
| CVE-2026-46408 | < 1.0.8.3 | Vvveb: checkout IDOR allows unauthorized reuse of another user's cart | HIGH 7.6 | 0.2 % | ||
| CVE-2026-46407 | < 1.0.8.3 | Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens | HIGH 8.1 | 0.2 % | ||
| CVE-2026-45800 | < 1.0.8.3 | Vvveb: Authenticated SQL injection in /user/orders via order_by and direction | HIGH 8.7 | 0.3 % | ||
| CVE-2026-45622 | < 1.0.8.3 | Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-45616 | < 1.0.8.3 | Vvveb: Stored XSS in Posts allows privilege escalation via post editor | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-44826 | < 1.0.8.2 | Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals | HIGH 7.5 | 0.3 % | ||
| CVE-2026-44366 | < 1.0.8.1 | Vvveb: Stored XSS via Comment Author Field | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-41937 | < 1.0.8.3 | Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload | HIGH 8.6 | 0.4 % | ||
| CVE-2026-41935 | < 1.0.8.3 | Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service | HIGH 7.1 | 0.3 % | ||
| CVE-2026-41933 | < 1.0.8.3 | Vvveb < 1.0.8.3 Directory Listing Information Disclosure | MEDIUM 6.9 | 0.2 % | ||
| CVE-2026-41932 | < 1.0.8.3 | Vvveb < 1.0.8.3 Stored XSS via Signup Controller | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-41928 | < 1.0.8.2 | Vvveb < 1.0.8.2 Information Disclosure via Cron Controller | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-41929 | < 1.0.8.2 | Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-41938 | < 1.0.8.2 | Vvveb < 1.0.8.2 RCE via Media Upload Handler | HIGH 8.7 | 0.7 % | ||
| CVE-2026-41930 | < 1.0.8.2 | Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin | CRITICAL 9.2 | 0.3 % | ||
| CVE-2026-41931 | < 1.0.8.2 | Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-41934 | < 1.0.8.2 | Vvveb < 1.0.8.2 Authenticated RCE via Code Editor | HIGH 8.7 | 0.5 % | ||
| CVE-2026-41936 | < 1.0.8.2 | Vvveb < 1.0.8.2 XML External Entity Injection via Import | HIGH 8.6 | 0.3 % | ||
| CVE-2026-39918 | < 1.0.8.1 | Vvveb < 1.0.8.1 Code Injection via Installation Endpoint | CRITICAL 9.2 | 0.7 % | ||
| CVE-2026-34428 | < 1.0.8.1 | Vvveb < 1.0.8.1 SSRF via oEmbedProxy | HIGH 8.3 | 0.3 % | ||
| CVE-2026-34427 | < 1.0.8.1 | Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save | HIGH 8.7 | 0.6 % | ||
| CVE-2026-34429 | < 1.0.8.1 | Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-12203 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 ; … | givanz Vvveb Code Editor functions.php sanitizeFileName path traversal | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-11944 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 ; … | givanz Vvveb Raw SQL import.php import sql injection | MEDIUM 5.1 | 0.6 % | ||
| CVE-2025-11029 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 | givanz Vvveb cross-site request forgery | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-11028 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 | givanz Vvveb Image information disclosure | MEDIUM 6.9 | 0.6 % | ||
| CVE-2025-11027 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 | givanz Vvveb SVG File cross site scripting | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-11026 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 | givanz Vvveb Configuration File information disclosure | MEDIUM 5.1 | 0.4 % | ||
| CVE-2025-9728 | 1.0.7.2 | givanz Vvveb login.tpl cross site scripting | MEDIUM 5.3 | 0.4 % | ||
| CVE-2025-9397 | 1.0.7.0 ; 1.0.7.1 ; 1.0.7.2 | givanz Vvveb media.php unrestricted upload | MEDIUM 5.3 | 0.5 % | ||
| CVE-2025-8976 | 1.0.0 ; 1.0.1 ; 1.0.2 ; … | givanz Vvveb Endpoint post cross site scripting | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-8975 | 1.0.0 ; 1.0.1 ; 1.0.2 ; … | givanz Vvveb edit.tpl cross site scripting | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-8521 | 1.0.0 ; 1.0.1 ; 1.0.2 ; … | givanz Vvveb Add Type post-types cross site scripting | MEDIUM 4.8 | 0.3 % | ||
| CVE-2025-8520 | 1.0.0 ; 1.0.1 ; 1.0.2 ; … | givanz Vvveb Drag-and-Drop Editor editor server-side request forgery | MEDIUM 5.1 | 0.4 % | ||
| CVE-2025-8519 | 1.0.0 ; 1.0.1 ; 1.0.2 ; … | givanz Vvveb Drag-and-Drop Editor editor information disclosure | MEDIUM 5.1 | 0.5 % | ||
| CVE-2025-8518 | 1.0.5 | givanz Vvveb Code Editor code.php save code injection | MEDIUM 5.1 | 2.3 % | ||
| CVE-2025-8517 | 1.0.6.1 | givanz Vvveb session fixiation | MEDIUM 5.3 | 2.3 % |