Vvveb vulnerabilities and CVEs
Known vulnerabilities affecting Vvveb, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
13 vulnerabilities tracked.
- 9.4 Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict…
- 9.4 Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing…
- 9.2 Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that uses loose comparison…
- 8.7 Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted siteadmin roles to inject PHP by saving .sql files…
- 8.7 Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or siteadmin users to write…
- 8.3 Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by…
- 7.2 Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite…
- 5.3 Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions…
- 5.3 Vvveb through 1.0.8.6 contains an SQL injection vulnerability in AdminAuthTokenSQL::update(), which interpolates adminauthtoken array keys…
- 5.3 Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action that lets…
- 5.3 Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT…
- 5.3 Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users'…
- 5.1 Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Vvveb is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Windows Server 2025 (Server Core installation) Windows Server 2025 Windows 11 version 26H1 Windows 11 Version 24H2 Windows 11 Version 25H2 Windows Server 2022 Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 21H2 Linux Windows 10 Version 22H2 Windows 10 Version 1809 Windows 11 Version 23H2 Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 10 Version 1607 Windows 11 Version 26H2 Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 (Server Core installation) Windows Server 2012 Red Hat Enterprise Linux 10