PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45622 givanz CVE debrief

Vvveb CMS versions prior to 1.0.8.3 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability in the public product return form. The `customer_order_id` POST parameter is inserted into an error message without HTML escaping, allowing attacker-controlled JavaScript to execute in the victim's browser when the order lookup fails. This is a client-side attack requiring user interaction (form submission), with CVSS 4.0 scoring indicating network attack vector, low attack complexity, no privileges required, and user interaction needed. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation).

Vendor
givanz
Product
Vvveb
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-15
Original CVE updated
2026-05-18
Advisory published
2026-05-15
Advisory updated
2026-05-18

Who should care

Organizations running Vvveb CMS for e-commerce or content management; security teams managing public-facing web applications; developers maintaining PHP-based CMS platforms

Technical summary

The vulnerability exists in the public product return form where the `customer_order_id` parameter is reflected into an 'Order %s not found!' error message without HTML escaping. When a user submits an invalid order ID containing malicious JavaScript, the payload executes in their browser context. This is a classic reflected XSS pattern where unsanitized user input reaches the DOM. The attack requires: (1) victim visits the return form, (2) victim submits form with attacker-crafted `customer_order_id` value (via direct submission or social engineering), (3) server responds with unescaped error message containing the payload. Impact is limited by the user interaction requirement and same-origin context, but could enable session hijacking or phishing within the application domain.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Vvveb CMS to version 1.0.8.3 or later to remediate this vulnerability
  • Implement Content Security Policy (CSP) headers to mitigate impact of any unpatched XSS vectors
  • Review and sanitize all user-supplied input in public-facing forms, ensuring proper HTML encoding before rendering in templates
  • Consider Web Application Firewall (WAF) rules to detect and block reflected XSS payloads in POST parameters
  • Audit similar order lookup and error message rendering patterns throughout the application for consistent output encoding

Evidence notes

Vulnerability confirmed via GitHub Security Advisory GHSA-3xwm-8f6m-cfc6. NVD status currently 'Deferred'. CVSS 4.0 vector provided in source metadata. Fix version 1.0.8.3 explicitly stated in advisory.

Official resources

2026-05-15