Ggivanz

Products

Exploited and recent CVEs

• CVE-2026-112905 Critical 9.0 Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft 0.5%
• CVE-2026-110799 Critical 9.8 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover 0.7%
• CVE-2026-112904 High 8.7 Vvveb: Path Traversal in nextRestore() and nextBackup() 0.5%
• CVE-2026-55232 High 7.6 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy 0.4%
• CVE-2026-55230 High 8.7 Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character 0.3%
• CVE-2026-55231 High 7.2 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools 0.5%
• CVE-2026-54506 High 7.6 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field 0.4%
• CVE-2026-54612 High 8.8 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global 0.8%
• CVE-2026-54613 Medium 5.4 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter 0.3%
• CVE-2026-54507 High 8.4 Vvveb oEmbedProxy vulnerable to server-side request forgery 0.4%
• CVE-2026-49223 High 7.6 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products 0.4%
• CVE-2026-49224 High 8.3 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions 0.5%
• CVE-2026-49222 High 7.6 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products 0.4%
• CVE-2026-49225 High 8.3 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions 0.5%
• CVE-2026-49228 High 8.8 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products 0.6%
• CVE-2026-49226 High 8.3 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts 0.5%
• CVE-2026-49227 High 7.6 Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts 0.4%
• CVE-2026-49221 High 8.8 Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets 0.6%
• CVE-2026-46408 High 7.6 Vvveb: checkout IDOR allows unauthorized reuse of another user's cart 0.2%
• CVE-2026-46407 High 8.1 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens 0.2%
• CVE-2026-45800 High 8.7 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction 0.3%
• CVE-2026-45622 Medium 5.3 Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id 0.3%
• CVE-2026-45616 Medium 5.1 Vvveb: Stored XSS in Posts allows privilege escalation via post editor 0.3%
• CVE-2026-44826 High 7.5 Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals 0.3%
• CVE-2026-44366 Medium 6.1 Vvveb: Stored XSS via Comment Author Field 0.3%
• CVE-2026-41937 High 7.2 Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload 0.4%
• CVE-2026-41935 High 7.1 Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service 0.3%
• CVE-2026-41933 Medium 5.3 Vvveb < 1.0.8.3 Directory Listing Information Disclosure 0.2%
• CVE-2026-41932 Medium 6.1 Vvveb < 1.0.8.3 Stored XSS via Signup Controller 0.2%
• CVE-2026-41928 Medium 5.3 Vvveb < 1.0.8.2 Information Disclosure via Cron Controller 0.4%