These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-54613 is a medium-severity vulnerability in Vvveb CMS that allows an authenticated user with Editor role and editor/* permission to disclose sensitive exported site content or remove backup data via a path traversal attack. The issue arises from the getThemeFolder() function in admin/controller/editor/revisions.php, which returns the attacker-controlled theme parameter without sanitization. The b [truncated]
A low-privileged Vendor in Vvveb CMS prior to 1.0.8.4 can access products owned by another Vendor, potentially exposing commercial information and causing unauthorized product details reading, duplication, or deletion, catalog pollution, or data loss. This issue arises from insufficient checks in the admin/controller/product/products.php controller and admin/sql/sqlite/product.sql, allowing unauthorized a [truncated]
CVE-2026-49225 is a high-severity vulnerability in the Vvveb CMS that allows low-privileged vendors to access and manipulate product revisions belonging to other vendors. This issue, fixed in version 1.0.8.4, could lead to unauthorized access to sensitive product content, corruption of live product pages, and removal of audit history. The vulnerability exists due to inadequate access control in the admin/ [truncated]
CVE-2026-49224 debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T17:16:57.977Z and has not been modified since then. The Vvveb CMS has a vulnerability allowing low-privileged authors to access revisions for posts owned by another author. This is due to the admin/controller/content/revisions.php controller and admin/sql/sqlite/post_content_revision.sql queries trusting [truncated]
CVE-2026-49223 is a vulnerability in Vvveb CMS that allows low-privileged vendors to manage reviews under another vendor's products, impacting review visibility and integrity. The vulnerability arises from the Vvveb backend product review operations, which permit a low-privileged Vendor to manage reviews under another Vendor's products. This issue is fixed in version 1.0.8.4. Defenders should assess expos [truncated]
CVE-2026-49222 is a vulnerability in Vvveb, a content management system (CMS), that allows a low-privileged Vendor to manage questions under another Vendor's products prior to version 1.0.8.4. This issue is fixed in version 1.0.8.4. The vulnerability is caused by inadequate access controls in the product question operations, allowing unauthorized access and potential manipulation of product Q&A visibility [truncated]
CVE-2026-49227 is a high-severity vulnerability in the Vvveb CMS that allows low-privileged authors to manage comments under another author's posts. This issue, fixed in version 1.0.8.4, enables attackers to read pending comment content, change moderation status, edit comment content, or delete comments, breaking author and moderation boundaries. The vulnerability is caused by the admin/controller/content [truncated]
A low-privileged Author in Vvveb CMS can access posts owned by another Author prior to version 1.0.8.4. This unauthorized access allows viewing of post metadata, discovery of post identifiers, duplication of posts, or deletion of posts, potentially exposing private drafts and causing content pollution, data loss, or business disruption. The issue arises from the admin/controller/content/posts.php controll [truncated]
CVE-2026-49221 is a high-severity vulnerability in the Vvveb CMS that allows low-privileged vendors to access digital assets linked to other vendors' products. This issue, fixed in version 1.0.8.4, could lead to unauthorized asset listing, metadata disclosure, and data loss. The vulnerability exists due to inconsistent enforcement of the current admin_id ownership boundary in digital asset operations. Def [truncated]
**Executive Summary:** CVE-2026-46407 is a HIGH severity (CVSS 8.1) authorization bypass vulnerability in Vvveb CMS affecting versions prior to 1.0.8.3. An authenticated administrator can exploit a missing authorization check on the backend `admin/auth-token` endpoint to enumerate and retrieve REST API tokens belonging to other administrators, leading to sensitive credential disclosure and potential privi [truncated]
CVE-2026-45800 affects Vvveb CMS prior to 1.0.8.3 and is described as an authenticated SQL injection in the frontend user order history page. A normal frontend user can log in, visit /user/orders, and influence the order_by and direction parameters. Those values are passed through the Orders component and concatenated into the SQL ORDER BY clause in OrderSQL::getAll() without a whitelist or safe query con [truncated]
Vvveb CMS versions prior to 1.0.8.3 contain an unauthenticated reflected cross-site scripting (XSS) vulnerability in the public product return form. The `customer_order_id` POST parameter is inserted into an error message without HTML escaping, allowing attacker-controlled JavaScript to execute in the victim's browser when the order lookup fails. This is a client-side attack requiring user interaction (fo [truncated]
Vvveb CMS versions prior to 1.0.8.3 contain a stored cross-site scripting (XSS) vulnerability classified as CWE-79. The vulnerability allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' sessions. The CVSS 4.0 vector indicates network attack vector with low attack complexity, requiring low privileges and user interaction, with impacts to co [truncated]
CVE-2026-44826 is a high-severity input-validation flaw in Vvveb CMS affecting the cart-add endpoint. Prior to 1.0.8.2, a negative quantity value is accepted and then propagated through cart and checkout calculations, producing negative line totals, subtotals, taxes, and grand totals. The issue can surface in the merchant dashboard as a real order with a negative total, creating an integrity and financial [truncated]
A stored cross-site scripting (XSS) vulnerability in Vvveb CMS allows unauthenticated attackers to inject malicious scripts via the author field in the comment submission flow. The vulnerability exists because user-supplied input is stored without sanitization and later rendered unsanitized in administrative interfaces. This affects versions prior to 1.0.8.1. The CVSS 3.1 score of 6.1 (Medium) reflects ne [truncated]
CVE-2026-41937 is an unrestricted file upload vulnerability in Vvveb before 1.0.8.3. The vulnerability allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticat [truncated]
CVE-2026-41935 is an uncontrolled recursion vulnerability in Vvveb before 1.0.8.3. The vulnerability is located in the admin controller dispatch cycle, where an error handler's permission() method can be repeatedly invoked, causing infinite recursion until PHP memory limits are exhausted. This can be exploited by sending sustained requests to forbidden admin URLs from a low-privilege account, leading to d [truncated]
CVE-2026-41933 is a directory listing information disclosure vulnerability in Vvveb before 1.0.8.3. The vulnerability allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper index directives in .htaccess files. This enables attackers to view filenames, file sizes, modification timestamps, and unrendered admin templates containing sensitive route maps. [truncated]
A stored cross-site scripting vulnerability exists in Vvveb before 1.0.8.3. The Signup::addUser() controller copies raw POST username values into the display_name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display_name column. This allows stored XSS execution w [truncated]
CVE-2026-41929 is an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer of Vvveb before 1.0.8.2. This vulnerability allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript [truncated]
CVE-2026-41928 is an information disclosure vulnerability in Vvveb before 1.0.8.2. The vulnerability is located in the cron controller and allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the inten [truncated]
CVE-2026-39918 is a critical vulnerability in Vvveb prior to version 1.0.8.1. The vulnerability is caused by a code injection issue in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. This allows attackers to inject arbitrary PHP code by breaking out of the string context in the define statement, achieving [truncated]
CVE-2026-34429 is a stored cross-site scripting vulnerability in Vvveb versions prior to 1.0.8.1. Authenticated users with media upload and rename permissions can bypass MIME type validation and rename uploaded files to executable extensions, allowing them to execute arbitrary JavaScript. Attackers can exploit this by prepending a GIF89a header to HTML/JavaScript payloads, renaming the file to .html, and [truncated]
CVE-2026-34428 is a server-side request forgery vulnerability in Vvveb prior to version 1.0.8.1. The vulnerability exists in the oEmbedProxy action of the editor/editor module, where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can exploit this vulnerability to read arbitrary files readable by the web server process or prob [truncated]
CVE-2026-34427 is a high-severity privilege escalation vulnerability in Vvveb versions prior to 1.0.8.1. Authenticated users can escalate privileges to Super Administrator by injecting role_id=1 into profile save requests, enabling plugin upload functionality for potential remote code execution. This vulnerability affects Vvveb installations and requires immediate attention from system administrators and [truncated]
A weakness has been identified in givanz Vvvebjs up to 2.0.5. The affected element is an unknown function of the file upload.php of the component File Upload Endpoint. This manipulation of the argument uploadAllowExtensions causes cross-site scripting. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Patch name: 8cac22cff99b8bc [truncated]