Vulnerability · Published Aug 31, 2025 · Assigned by VulDB

CVE-2025-9728givanz Vvveb login.tpl cross site scripting

Medium 4.3

In plain English

A medium-severity cross-site scripting in Vvveb from givanz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of the argument Email/Password leads to cross site scripting. The attack can be executed remotely. The name of the patch is bbd4c42c66ab818142240348173a669d1d2537fe. Applying a patch is advised to resolve this issue.

Affected products (as reported)

Vendor	Product	Versions
givanz	Vvveb	1.0.7.2

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References

VDB-322017 | givanz Vvveb login.tpl cross site scripting vdb-entry, technical-description
VDB-322017 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #639704 | givanz Vvveb 1.0.7.2 Cross Site Scripting third-party-advisory
https://github.com/kwerty138/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 related
https://github.com/givanz/Vvveb/issues/323 issue-tracking
https://github.com/givanz/Vvveb/commit/bbd4c42c66ab818142240348173a669d1d2537fe patch