# givanz Vvveb. Every CVE that names givanz Vvveb among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft](https://agentprime.io/advisories/CVE-2026-112905.md) `CVE-2026-112905` · CVE record: givanz Vvveb · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control - [Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover](https://agentprime.io/advisories/CVE-2026-110799.md) `CVE-2026-110799` · CVE record: givanz Vvveb · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass - [Vvveb: Path Traversal in nextRestore() and nextBackup()](https://agentprime.io/advisories/CVE-2026-112904.md) `CVE-2026-112904` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-26 - [Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy](https://agentprime.io/advisories/CVE-2026-55232.md) `CVE-2026-55232` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Server-side request forgery (SSRF) - [Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character](https://agentprime.io/advisories/CVE-2026-55230.md) `CVE-2026-55230` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Cross-site scripting (XSS) - [Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools](https://agentprime.io/advisories/CVE-2026-55231.md) `CVE-2026-55231` · CVE record: givanz Vvveb · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal - [Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field](https://agentprime.io/advisories/CVE-2026-54506.md) `CVE-2026-54506` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 17 Sept 2026 · Tags: Cross-site scripting (XSS), CWE-116, CWE-185 - [Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global](https://agentprime.io/advisories/CVE-2026-54612.md) `CVE-2026-54612` · CVE record: givanz Vvveb · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Code injection - [Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter](https://agentprime.io/advisories/CVE-2026-54613.md) `CVE-2026-54613` · CVE record: givanz Vvveb · CVSS 5.4 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal - [Vvveb oEmbedProxy vulnerable to server-side request forgery](https://agentprime.io/advisories/CVE-2026-54507.md) `CVE-2026-54507` · CVE record: givanz Vvveb · CVSS 8.4 High · Not analysed yet · Published 17 Sept 2026 · Tags: Server-side request forgery (SSRF) - [Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products](https://agentprime.io/advisories/CVE-2026-49223.md) `CVE-2026-49223` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions](https://agentprime.io/advisories/CVE-2026-49224.md) `CVE-2026-49224` · CVE record: givanz Vvveb · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products](https://agentprime.io/advisories/CVE-2026-49222.md) `CVE-2026-49222` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions](https://agentprime.io/advisories/CVE-2026-49225.md) `CVE-2026-49225` · CVE record: givanz Vvveb · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products](https://agentprime.io/advisories/CVE-2026-49228.md) `CVE-2026-49228` · CVE record: givanz Vvveb · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts](https://agentprime.io/advisories/CVE-2026-49226.md) `CVE-2026-49226` · CVE record: givanz Vvveb · CVSS 8.3 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts](https://agentprime.io/advisories/CVE-2026-49227.md) `CVE-2026-49227` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets](https://agentprime.io/advisories/CVE-2026-49221.md) `CVE-2026-49221` · CVE record: givanz Vvveb · CVSS 8.8 High · Not analysed yet · Published 18 Aug 2026 · Tags: Broken access control - [Vvveb: checkout IDOR allows unauthorized reuse of another user's cart](https://agentprime.io/advisories/CVE-2026-46408.md) `CVE-2026-46408` · CVE record: givanz Vvveb · CVSS 7.6 High · Not analysed yet · Published 15 May 2026 · Tags: Broken access control - [Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens](https://agentprime.io/advisories/CVE-2026-46407.md) `CVE-2026-46407` · CVE record: givanz Vvveb · CVSS 8.1 High · Not analysed yet · Published 15 May 2026 · Tags: Broken access control - [Vvveb: Authenticated SQL injection in /user/orders via order_by and direction](https://agentprime.io/advisories/CVE-2026-45800.md) `CVE-2026-45800` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 15 May 2026 · Tags: SQL injection - [Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id](https://agentprime.io/advisories/CVE-2026-45622.md) `CVE-2026-45622` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 15 May 2026 · Tags: Cross-site scripting (XSS) - [Vvveb: Stored XSS in Posts allows privilege escalation via post editor](https://agentprime.io/advisories/CVE-2026-45616.md) `CVE-2026-45616` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 15 May 2026 · Tags: Cross-site scripting (XSS) - [Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals](https://agentprime.io/advisories/CVE-2026-44826.md) `CVE-2026-44826` · CVE record: givanz Vvveb · CVSS 7.5 High · Not analysed yet · Published 15 May 2026 · Tags: CWE-1284 - [Vvveb: Stored XSS via Comment Author Field](https://agentprime.io/advisories/CVE-2026-44366.md) `CVE-2026-44366` · CVE record: givanz Vvveb · CVSS 6.1 Medium · Not analysed yet · Published 15 May 2026 · Tags: Cross-site scripting (XSS) - [Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload](https://agentprime.io/advisories/CVE-2026-41937.md) `CVE-2026-41937` · CVE record: givanz Vvveb · CVSS 8.6 High · Not analysed yet · Published 14 May 2026 · Tags: Unrestricted file upload, CWE-61 - [Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service](https://agentprime.io/advisories/CVE-2026-41935.md) `CVE-2026-41935` · CVE record: givanz Vvveb · CVSS 7.1 High · Not analysed yet · Published 14 May 2026 · Tags: Information disclosure, Denial of service - [Vvveb < 1.0.8.3 Directory Listing Information Disclosure](https://agentprime.io/advisories/CVE-2026-41933.md) `CVE-2026-41933` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 14 May 2026 · Tags: CWE-548 - [Vvveb < 1.0.8.3 Stored XSS via Signup Controller](https://agentprime.io/advisories/CVE-2026-41932.md) `CVE-2026-41932` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Cross-site scripting (XSS) - [Vvveb < 1.0.8.2 Information Disclosure via Cron Controller](https://agentprime.io/advisories/CVE-2026-41928.md) `CVE-2026-41928` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 7 May 2026 · Tags: Information disclosure - [Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor](https://agentprime.io/advisories/CVE-2026-41929.md) `CVE-2026-41929` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 7 May 2026 · Tags: Cross-site scripting (XSS) - [Vvveb < 1.0.8.2 RCE via Media Upload Handler](https://agentprime.io/advisories/CVE-2026-41938.md) `CVE-2026-41938` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: Unrestricted file upload - [Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin](https://agentprime.io/advisories/CVE-2026-41930.md) `CVE-2026-41930` · CVE record: givanz Vvveb · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 May 2026 · Tags: Authentication bypass - [Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler](https://agentprime.io/advisories/CVE-2026-41931.md) `CVE-2026-41931` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 6 May 2026 · Tags: Information disclosure, CWE-1188 - [Vvveb < 1.0.8.2 Authenticated RCE via Code Editor](https://agentprime.io/advisories/CVE-2026-41934.md) `CVE-2026-41934` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 6 May 2026 · Tags: CWE-184 - [Vvveb < 1.0.8.2 XML External Entity Injection via Import](https://agentprime.io/advisories/CVE-2026-41936.md) `CVE-2026-41936` · CVE record: givanz Vvveb · CVSS 8.6 High · Not analysed yet · Published 6 May 2026 · Tags: XML external entities (XXE) - [Vvveb < 1.0.8.1 Code Injection via Installation Endpoint](https://agentprime.io/advisories/CVE-2026-39918.md) `CVE-2026-39918` · CVE record: givanz Vvveb · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Apr 2026 · Tags: Code injection - [Vvveb < 1.0.8.1 SSRF via oEmbedProxy](https://agentprime.io/advisories/CVE-2026-34428.md) `CVE-2026-34428` · CVE record: givanz Vvveb · CVSS 8.3 High · Not analysed yet · Published 20 Apr 2026 · Tags: Server-side request forgery (SSRF) - [Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save](https://agentprime.io/advisories/CVE-2026-34427.md) `CVE-2026-34427` · CVE record: givanz Vvveb · CVSS 8.7 High · Not analysed yet · Published 20 Apr 2026 · Tags: Broken access control - [Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename](https://agentprime.io/advisories/CVE-2026-34429.md) `CVE-2026-34429` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: Cross-site scripting (XSS) - [givanz Vvveb Code Editor functions.php sanitizeFileName path traversal](https://agentprime.io/advisories/CVE-2025-12203.md) `CVE-2025-12203` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: Path traversal - [givanz Vvveb Raw SQL import.php import sql injection](https://agentprime.io/advisories/CVE-2025-11944.md) `CVE-2025-11944` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2025 · Tags: Other injection, SQL injection - [givanz Vvveb cross-site request forgery](https://agentprime.io/advisories/CVE-2025-11029.md) `CVE-2025-11029` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site request forgery (CSRF), Broken access control - [givanz Vvveb Image information disclosure](https://agentprime.io/advisories/CVE-2025-11028.md) `CVE-2025-11028` · CVE record: givanz Vvveb · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Information disclosure, Broken access control - [givanz Vvveb SVG File cross site scripting](https://agentprime.io/advisories/CVE-2025-11027.md) `CVE-2025-11027` · CVE record: givanz Vvveb · CVSS 4.8 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb Configuration File information disclosure](https://agentprime.io/advisories/CVE-2025-11026.md) `CVE-2025-11026` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 26 Sept 2025 · Tags: Information disclosure, Broken access control - [givanz Vvveb login.tpl cross site scripting](https://agentprime.io/advisories/CVE-2025-9728.md) `CVE-2025-9728` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 31 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb media.php unrestricted upload](https://agentprime.io/advisories/CVE-2025-9397.md) `CVE-2025-9397` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 24 Aug 2025 · Tags: Broken access control, Unrestricted file upload - [givanz Vvveb Endpoint post cross site scripting](https://agentprime.io/advisories/CVE-2025-8976.md) `CVE-2025-8976` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb edit.tpl cross site scripting](https://agentprime.io/advisories/CVE-2025-8975.md) `CVE-2025-8975` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb Add Type post-types cross site scripting](https://agentprime.io/advisories/CVE-2025-8521.md) `CVE-2025-8521` · CVE record: givanz Vvveb · CVSS 4.8 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Cross-site scripting (XSS), Code injection - [givanz Vvveb Drag-and-Drop Editor editor server-side request forgery](https://agentprime.io/advisories/CVE-2025-8520.md) `CVE-2025-8520` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Server-side request forgery (SSRF) - [givanz Vvveb Drag-and-Drop Editor editor information disclosure](https://agentprime.io/advisories/CVE-2025-8519.md) `CVE-2025-8519` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Information disclosure, Broken access control - [givanz Vvveb Code Editor code.php save code injection](https://agentprime.io/advisories/CVE-2025-8518.md) `CVE-2025-8518` · CVE record: givanz Vvveb · CVSS 5.1 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Other injection, Code injection - [givanz Vvveb session fixiation](https://agentprime.io/advisories/CVE-2025-8517.md) `CVE-2025-8517` · CVE record: givanz Vvveb · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: Authentication bypass ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .