Vvveb vulnerabilities

CVE-2026-6257 Critical · 9.1 CWE-434 Apr 20, 2026

Vvveb CMS RCE via Unrestricted File Rename in Media Manager

Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing return statement in the file rename handler allows authenticated attackers to rename files to blocked extensions .php or .htaccess. Attackers can exploit this logic flaw by first uploading a text file and renaming it to .htaccess to inject Apache directives that register PHP-executable MIME types, then uploading another file and renaming it to .php to execute arbitrary operating system commands as the www-data user.

CVE-2026-6249 High · 8.8 CWE-434 Apr 20, 2026

Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.

CVE-2024-27480 Critical · 9.8 CWE-434 Dec 29, 2025

Unrestricted Upload of File with Dangerous Type in Vvveb Vvvebjs

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.

CVE-2024-25183 High · 7.5 CWE-22 Dec 29, 2025

Path Traversal in Vvveb Vvvebjs

givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.

CVE-2024-25182 Critical · 9.8 CWE-434 Dec 29, 2025

Unrestricted Upload of File with Dangerous Type in Vvveb Vvvebjs

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.

CVE-2024-25181 Critical · 9.1 CWE-918 Dec 29, 2025

Server-Side Request Forgery (SSRF) in Vvveb Vvvebjs

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.

CVE-2025-12203 Medium · 4.9 CWE-22 Oct 27, 2025

givanz Vvveb Code Editor functions.php sanitizeFileName path traversal

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

CVE-2025-11944 High · 7.2 CWE-89 Oct 19, 2025

givanz Vvveb Raw SQL import.php import sql injection

A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.

CVE-2025-11029 High · 8.8 CWE-352 Sep 26, 2025

givanz Vvveb cross-site request forgery

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11028 High · 7.5 CWE-200 Sep 26, 2025

givanz Vvveb Image information disclosure

A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11027 Medium · 5.4 CWE-79 Sep 26, 2025

givanz Vvveb SVG File cross site scripting

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11026 High · 7.5 CWE-200 Sep 26, 2025

givanz Vvveb Configuration File information disclosure

A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."