These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
**Executive Summary:** CVE-2026-46407 is a HIGH severity (CVSS 8.1) authorization bypass vulnerability in Vvveb CMS affecting versions prior to 1.0.8.3. An authenticated administrator can exploit a missing authorization check on the backend `admin/auth-token` endpoint to enumerate and retrieve REST API tokens belonging to other administrators, leading to sensitive credential disclosure and potential privi [truncated]
CVE-2026-45800 affects Vvveb CMS prior to 1.0.8.3 and is described as an authenticated SQL injection in the frontend user order history page. A normal frontend user can log in, visit /user/orders, and influence the order_by and direction parameters. Those values are passed through the Orders component and concatenated into the SQL ORDER BY clause in OrderSQL::getAll() without a whitelist or safe query con [truncated]
Vvveb CMS versions prior to 1.0.8.3 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability in the public product return form. The `customer_order_id` POST parameter is inserted into an error message without HTML escaping, allowing attacker-controlled JavaScript to execute in the victim's browser when the order lookup fails. This is a client-side attack requiring user interaction (fo [truncated]
Vvveb CMS versions prior to 1.0.8.3 contain a stored cross-site scripting (XSS) vulnerability classified as CWE-79. The vulnerability allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' sessions. The CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring low privileges and user interaction, with impacts to co [truncated]
CVE-2026-44826 is a high-severity input-validation flaw in Vvveb CMS affecting the cart-add endpoint. Prior to 1.0.8.2, a negative quantity value is accepted and then propagated through cart and checkout calculations, producing negative line totals, subtotals, taxes, and grand totals. The issue can surface in the merchant dashboard as a real order with a negative total, creating an integrity and financial [truncated]
A stored cross-site scripting (XSS) vulnerability in Vvveb CMS allows unauthenticated attackers to inject malicious scripts via the author field in the comment submission flow. The vulnerability exists because user-supplied input is stored without sanitization and later rendered unsanitized in administrative interfaces. This affects versions prior to 1.0.8.1. The CVSS 3.1 score of 6.1 (Medium) reflects ne [truncated]
CVE-2026-41937 is an unrestricted file upload vulnerability in Vvveb before 1.0.8.3. The vulnerability allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticat [truncated]
CVE-2026-41935 is an uncontrolled recursion vulnerability in Vvveb before 1.0.8.3. The vulnerability is located in the admin controller dispatch cycle, where an error handler's permission() method can be repeatedly invoked, causing infinite recursion until PHP memory limits are exhausted. This can be exploited by sending sustained requests to forbidden admin URLs from a low-privilege account, leading to d [truncated]
CVE-2026-41933 is a directory listing information disclosure vulnerability in Vvveb before 1.0.8.3. The vulnerability allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. This enables attackers to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps. [truncated]
A stored cross-site scripting vulnerability exists in Vvveb before 1.0.8.3. The Signup::addUser() controller copies raw POST username values into the display_name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display_name column. This allows stored XSS execution w [truncated]
CVE-2026-41929 is an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer of Vvveb before 1.0.8.2. This vulnerability allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript [truncated]
CVE-2026-41928 is an information disclosure vulnerability in Vvveb before 1.0.8.2. The vulnerability is located in the cron controller and allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the inten [truncated]
CVE-2026-39918 is a critical vulnerability in Vvveb prior to version 1.0.8.1. The vulnerability is caused by a code injection issue in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. This allows attackers to inject arbitrary PHP code by breaking out of the string context in the define statement, achieving [truncated]
CVE-2026-34429 is a stored cross-site scripting vulnerability in Vvveb versions prior to 1.0.8.1. Authenticated users with media upload and rename permissions can bypass MIME type validation and rename uploaded files to executable extensions, allowing them to execute arbitrary JavaScript. Attackers can exploit this by prepending a GIF89a header to HTML/JavaScript payloads, renaming the file to .html, and [truncated]
CVE-2026-34428 is a server-side request forgery vulnerability in Vvveb prior to version 1.0.8.1. The vulnerability exists in the oEmbedProxy action of the editor/editor module, where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can exploit this vulnerability to read arbitrary files readable by the web server process or prob [truncated]
CVE-2026-34427 is a high-severity privilege escalation vulnerability in Vvveb versions prior to 1.0.8.1. Authenticated users can escalate privileges to Super Administrator by injecting role_id=1 into profile save requests, enabling plugin upload functionality for potential remote code execution. This vulnerability affects Vvveb installations and requires immediate attention from system administrators and [truncated]
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross-site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc [truncated]