givanz Vvveb

• CVE-2026-112905 Critical 9.0 Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft 0.5%
• CVE-2026-110799 Critical 9.8 Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover 0.7%
• CVE-2026-112904 High 8.7 Vvveb: Path Traversal in nextRestore() and nextBackup() 0.5%
• CVE-2026-55232 High 7.6 Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy 0.4%
• CVE-2026-55230 High 8.7 Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character 0.3%
• CVE-2026-55231 High 7.2 Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools 0.5%
• CVE-2026-54506 High 7.6 Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field 0.4%
• CVE-2026-54612 High 8.8 Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global 0.8%
• CVE-2026-54613 Medium 5.4 Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter 0.3%
• CVE-2026-54507 High 8.4 Vvveb oEmbedProxy vulnerable to server-side request forgery 0.4%
• CVE-2026-49223 High 7.6 Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products 0.4%
• CVE-2026-49224 High 8.3 Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions 0.5%
• CVE-2026-49222 High 7.6 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products 0.4%
• CVE-2026-49225 High 8.3 Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions 0.5%
• CVE-2026-49228 High 8.8 Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products 0.6%
• CVE-2026-49226 High 8.3 Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts 0.5%
• CVE-2026-49227 High 7.6 Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts 0.4%
• CVE-2026-49221 High 8.8 Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets 0.6%
• CVE-2026-46408 High 7.6 Vvveb: checkout IDOR allows unauthorized reuse of another user's cart 0.2%
• CVE-2026-46407 High 8.1 Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens 0.2%
• CVE-2026-45800 High 8.7 Vvveb: Authenticated SQL injection in /user/orders via order_by and direction 0.3%
• CVE-2026-45622 Medium 5.3 Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id 0.3%
• CVE-2026-45616 Medium 5.1 Vvveb: Stored XSS in Posts allows privilege escalation via post editor 0.3%
• CVE-2026-44826 High 7.5 Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals 0.3%
• CVE-2026-44366 Medium 6.1 Vvveb: Stored XSS via Comment Author Field 0.3%
• CVE-2026-41937 High 7.2 Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload 0.4%
• CVE-2026-41935 High 7.1 Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service 0.3%
• CVE-2026-41933 Medium 5.3 Vvveb < 1.0.8.3 Directory Listing Information Disclosure 0.2%
• CVE-2026-41932 Medium 6.1 Vvveb < 1.0.8.3 Stored XSS via Signup Controller 0.2%
• CVE-2026-41928 Medium 5.3 Vvveb < 1.0.8.2 Information Disclosure via Cron Controller 0.4%
• CVE-2026-41929 Medium 6.1 Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor 0.2%
• CVE-2026-41938 High 8.8 Vvveb < 1.0.8.2 RCE via Media Upload Handler 0.7%
• CVE-2026-41930 Critical 9.8 Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin 0.3%
• CVE-2026-41931 Medium 5.3 Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler 0.3%
• CVE-2026-41934 High 8.8 Vvveb < 1.0.8.2 Authenticated RCE via Code Editor 0.5%
• CVE-2026-41936 High 8.1 Vvveb < 1.0.8.2 XML External Entity Injection via Import 0.3%
• CVE-2026-39918 Critical 9.8 Vvveb < 1.0.8.1 Code Injection via Installation Endpoint 0.7%
• CVE-2026-34428 High 7.7 Vvveb < 1.0.8.1 SSRF via oEmbedProxy 0.3%
• CVE-2026-34427 High 8.8 Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save 0.6%
• CVE-2026-34429 Medium 5.4 Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename 0.3%
• CVE-2025-12203 Medium 6.3 givanz Vvveb Code Editor functions.php sanitizeFileName path traversal 0.4%
• CVE-2025-11944 Medium 4.7 givanz Vvveb Raw SQL import.php import sql injection 0.6%
• CVE-2025-11029 Medium 4.3 givanz Vvveb cross-site request forgery 0.3%
• CVE-2025-11028 Medium 5.3 givanz Vvveb Image information disclosure 0.6%
• CVE-2025-11027 Low 2.4 givanz Vvveb SVG File cross site scripting 0.3%
• CVE-2025-11026 Low 3.5 givanz Vvveb Configuration File information disclosure 0.4%
• CVE-2025-9728 Medium 4.3 givanz Vvveb login.tpl cross site scripting 0.4%
• CVE-2025-9397 Medium 6.3 givanz Vvveb media.php unrestricted upload 0.5%
• CVE-2025-8976 Low 3.5 givanz Vvveb Endpoint post cross site scripting 0.3%
• CVE-2025-8975 Low 3.5 givanz Vvveb edit.tpl cross site scripting 0.3%