Vulnerabilidades de Vvveb

CVE-2026-6257 Crítica · 9.1 CWE-434 20/04/2026

Vvveb CMS: RCE por renomeação irrestrita de arquivos no gerenciador de mídia

Vvveb CMS v1.0.8.2 contém uma vulnerabilidade de execução remota de código em sua funcionalidade de gerenciamento de mídia, na qual a ausência de uma instrução return no manipulador de renomeação de arquivos permite que atacantes autenticados renomeiem arquivos para extensões bloqueadas .php ou .htaccess. Atacantes podem explorar essa falha de lógica primeiro enviando um arquivo de texto e renomeando-o para .htaccess a fim de injetar diretivas do Apache que registram tipos MIME executáveis como PHP, e depois enviando outro arquivo e renomeando-o para .php para executar comandos arbitrários do sistema operacional como o usuário www-data.

CVE-2026-6249 Alta · 8.8 CWE-434 20/04/2026

Vvveb CMS 1.0.8.2 Remote Code Execution via Media Upload

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated attackers to execute arbitrary operating system commands by uploading a PHP webshell with a .phtml extension. Attackers can bypass the extension deny-list and upload malicious files to the publicly accessible media directory, then request the file over HTTP to achieve full server compromise.

CVE-2024-27480 Crítica · 9.8 CWE-434 29/12/2025

Unrestricted Upload of File with Dangerous Type em Vvveb Vvvebjs

givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.

CVE-2024-25183 Alta · 7.5 CWE-22 29/12/2025

Path Traversal em Vvveb Vvvebjs

givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.

CVE-2024-25182 Crítica · 9.8 CWE-434 29/12/2025

Unrestricted Upload of File with Dangerous Type em Vvveb Vvvebjs

givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.

CVE-2024-25181 Crítica · 9.1 CWE-918 29/12/2025

Server-Side Request Forgery (SSRF) em Vvveb Vvvebjs

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.

CVE-2025-12203 Média · 4.9 CWE-22 27/10/2025

givanz Vvveb Code Editor functions.php sanitizeFileName path traversal

A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file system/functions.php of the component Code Editor. Executing a manipulation of the argument File can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b0fa7ff74a3539c6d37000db152caad572e4c39b. Applying a patch is advised to resolve this issue.

CVE-2025-11944 Alta · 7.2 CWE-89 19/10/2025

givanz Vvveb Raw SQL import.php import sql injection

A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.

CVE-2025-11029 Alta · 8.8 CWE-352 26/09/2025

givanz Vvveb cross-site request forgery

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11028 Alta · 7.5 CWE-200 26/09/2025

givanz Vvveb Image information disclosure

A security flaw has been discovered in givanz Vvveb up to 1.0.7.2. This affects an unknown part of the component Image Handler. Performing manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11027 Média · 5.4 CWE-79 26/09/2025

givanz Vvveb SVG File cross site scripting

A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

CVE-2025-11026 Alta · 7.5 CWE-200 26/09/2025

givanz Vvveb Configuration File information disclosure

A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."