Skip to content
Givanz Vvveb vulnerabilities
-
givanz vvveb
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
CVE-2026-112905
9.0 Critical
-
givanz vvveb
Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover
CVE-2026-110799
9.8 Critical
-
givanz vvveb
Vvveb: Path Traversal in nextRestore() and nextBackup()
CVE-2026-112904
8.7 High
-
givanz vvveb
Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
CVE-2026-55232
7.6 High
-
givanz vvveb
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
CVE-2026-55230
8.7 High
-
givanz vvveb
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
CVE-2026-55231
7.2 High
-
givanz vvveb
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
CVE-2026-54506
7.6 High
-
givanz vvveb
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
CVE-2026-54612
8.8 High
-
givanz vvveb
Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
CVE-2026-54613
5.4 Medium
-
givanz vvveb
Vvveb oEmbedProxy vulnerable to server-side request forgery
CVE-2026-54507
8.4 High
-
givanz vvveb
Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
CVE-2026-49223
7.6 High
-
givanz vvveb
Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
CVE-2026-49224
8.3 High
-
givanz vvveb
Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
CVE-2026-49222
7.6 High
-
givanz vvveb
Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
CVE-2026-49225
8.3 High
-
givanz vvveb
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
CVE-2026-49228
8.8 High
-
givanz vvveb
Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
CVE-2026-49226
8.3 High
-
givanz vvveb
Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
CVE-2026-49227
7.6 High
-
givanz vvveb
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
CVE-2026-49221
8.8 High
-
givanz vvveb
Vvveb: checkout IDOR allows unauthorized reuse of another user's cart
CVE-2026-46408
7.6 High
-
givanz vvveb
Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens
CVE-2026-46407
8.1 High
-
givanz vvveb
Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
CVE-2026-45800
8.7 High
-
givanz vvveb
Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id
CVE-2026-45622
5.3 Medium
-
givanz vvveb
Vvveb: Stored XSS in Posts allows privilege escalation via post editor
CVE-2026-45616
5.1 Medium
-
givanz vvveb
Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals
CVE-2026-44826
7.5 High
-
givanz vvveb
Vvveb: Stored XSS via Comment Author Field
CVE-2026-44366
6.1 Medium
-
givanz vvveb
Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
CVE-2026-41937
8.6 High
-
givanz vvveb
Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service
CVE-2026-41935
7.1 High
-
givanz vvveb
Vvveb < 1.0.8.3 Directory Listing Information Disclosure
CVE-2026-41933
6.9 Medium
-
givanz vvveb
Vvveb < 1.0.8.3 Stored XSS via Signup Controller
CVE-2026-41932
5.3 Medium
-
givanz vvveb
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller
CVE-2026-41928
6.9 Medium
-
givanz vvveb
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
CVE-2026-41929
5.1 Medium
-
givanz vvveb
Vvveb < 1.0.8.2 RCE via Media Upload Handler
CVE-2026-41938
8.7 High
-
givanz vvveb
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
CVE-2026-41930
9.2 Critical
-
givanz vvveb
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
CVE-2026-41931
6.9 Medium
-
givanz vvveb
Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
CVE-2026-41934
8.7 High
-
givanz vvveb
Vvveb < 1.0.8.2 XML External Entity Injection via Import
CVE-2026-41936
8.6 High
-
givanz vvveb
Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
CVE-2026-39918
9.2 Critical
-
givanz vvveb
Vvveb < 1.0.8.1 SSRF via oEmbedProxy
CVE-2026-34428
8.3 High
-
givanz vvveb
Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
CVE-2026-34427
8.7 High
-
givanz vvveb
Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
CVE-2026-34429
5.1 Medium
-
givanz vvvebjs
givanz Vvvebjs File Upload Endpoint upload.php cross site scripting
CVE-2026-5615
Public exploit
5.3 Medium
-
givanz vvveb
givanz Vvveb Code Editor functions.php sanitizeFileName path traversal
CVE-2025-12203
5.3 Medium
-
givanz vvveb
givanz Vvveb Raw SQL import.php import sql injection
CVE-2025-11944
5.1 Medium
-
givanz vvveb
givanz Vvveb cross-site request forgery
CVE-2025-11029
5.3 Medium
-
givanz vvveb
givanz Vvveb Image information disclosure
CVE-2025-11028
6.9 Medium
-
givanz vvveb
givanz Vvveb SVG File cross site scripting
CVE-2025-11027
4.8 Medium
-
givanz vvveb
givanz Vvveb Configuration File information disclosure
CVE-2025-11026
5.1 Medium
-
givanz vvveb
givanz Vvveb login.tpl cross site scripting
CVE-2025-9728
Public exploit
5.3 Medium
-
givanz vvveb
givanz Vvveb media.php unrestricted upload
CVE-2025-9397
5.3 Medium
-
givanz vvveb
givanz Vvveb Endpoint post cross site scripting
CVE-2025-8976
5.1 Medium
- Show olderLoading…