Advisories · Technology
givanz Vvveb.
Every CVE that names givanz Vvveb among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.0 CriticalCritical · CVSS 9+
Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
- givanz Vvveb
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover
- givanz Vvveb
- Authentication bypass
- CVSS 8.7 High
Vvveb: Path Traversal in nextRestore() and nextBackup()
- givanz Vvveb
- CWE-26
- CVSS 7.6 High
Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
- givanz Vvveb
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 7.2 High
Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
- givanz Vvveb
- Path traversal
- CVSS 7.6 High
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
- givanz Vvveb
- Cross-site scripting (XSS)
- CWE-116
- CVSS 8.8 High
Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
- givanz Vvveb
- Path traversal
- Code injection
- CVSS 5.4 Medium
Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
- givanz Vvveb
- Path traversal
- CVSS 8.4 High
Vvveb oEmbedProxy vulnerable to server-side request forgery
- givanz Vvveb
- Server-side request forgery (SSRF)
- CVSS 7.6 High
Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
- givanz Vvveb
- Broken access control
- CVSS 8.3 High
Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
- givanz Vvveb
- Broken access control
- CVSS 7.6 High
Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
- givanz Vvveb
- Broken access control
- CVSS 8.3 High
Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
- givanz Vvveb
- Broken access control
- CVSS 8.8 High
Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
- givanz Vvveb
- Broken access control
- CVSS 8.3 High
Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
- givanz Vvveb
- Broken access control
- CVSS 7.6 High
Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
- givanz Vvveb
- Broken access control
- CVSS 8.8 High
Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
- givanz Vvveb
- Broken access control
- CVSS 7.6 High
Vvveb: checkout IDOR allows unauthorized reuse of another user's cart
- givanz Vvveb
- Broken access control
- CVSS 8.1 High
Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens
- givanz Vvveb
- Broken access control
- CVSS 8.7 High
Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
- givanz Vvveb
- SQL injection
- CVSS 5.3 Medium
Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Vvveb: Stored XSS in Posts allows privilege escalation via post editor
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 7.5 High
Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals
- givanz Vvveb
- CWE-1284
- CVSS 6.1 Medium
Vvveb: Stored XSS via Comment Author Field
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 8.6 High
Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
- givanz Vvveb
- Unrestricted file upload
- CWE-61
- CVSS 7.1 High
Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service
- givanz Vvveb
- Information disclosure
- Denial of service
- CVSS 6.9 Medium
Vvveb < 1.0.8.3 Directory Listing Information Disclosure
- givanz Vvveb
- CWE-548
- CVSS 5.3 Medium
Vvveb < 1.0.8.3 Stored XSS via Signup Controller
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller
- givanz Vvveb
- Information disclosure
- CVSS 5.1 Medium
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 8.7 High
Vvveb < 1.0.8.2 RCE via Media Upload Handler
- givanz Vvveb
- Unrestricted file upload
- CVSS 9.2 CriticalCritical · CVSS 9+
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin
- givanz Vvveb
- Authentication bypass
- CVSS 6.9 Medium
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
- givanz Vvveb
- Information disclosure
- CWE-1188
- CVSS 8.7 High
Vvveb < 1.0.8.2 Authenticated RCE via Code Editor
- givanz Vvveb
- CWE-184
- CVSS 8.6 High
Vvveb < 1.0.8.2 XML External Entity Injection via Import
- givanz Vvveb
- XML external entities (XXE)
- CVSS 9.2 CriticalCritical · CVSS 9+
Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
- givanz Vvveb
- Code injection
- CVSS 8.3 High
Vvveb < 1.0.8.1 SSRF via oEmbedProxy
- givanz Vvveb
- Server-side request forgery (SSRF)
- CVSS 8.7 High
Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
- givanz Vvveb
- Broken access control
- CVSS 5.1 Medium
Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
givanz Vvveb Code Editor functions.php sanitizeFileName path traversal
- givanz Vvveb
- Path traversal
- CVSS 5.1 Medium
givanz Vvveb Raw SQL import.php import sql injection
- givanz Vvveb
- Other injection
- SQL injection
- CVSS 5.3 Medium
givanz Vvveb cross-site request forgery
- givanz Vvveb
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 6.9 Medium
givanz Vvveb Image information disclosure
- givanz Vvveb
- Information disclosure
- Broken access control
- CVSS 4.8 Medium
givanz Vvveb SVG File cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb Configuration File information disclosure
- givanz Vvveb
- Information disclosure
- Broken access control
- CVSS 5.3 Medium
givanz Vvveb login.tpl cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
givanz Vvveb media.php unrestricted upload
- givanz Vvveb
- Broken access control
- Unrestricted file upload
- CVSS 5.1 Medium
givanz Vvveb Endpoint post cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb edit.tpl cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
givanz Vvveb Add Type post-types cross site scripting
- givanz Vvveb
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
givanz Vvveb Drag-and-Drop Editor editor server-side request forgery
- givanz Vvveb
- Server-side request forgery (SSRF)
- CVSS 5.1 Medium
givanz Vvveb Drag-and-Drop Editor editor information disclosure
- givanz Vvveb
- Information disclosure
- Broken access control
- CVSS 5.1 Medium
givanz Vvveb Code Editor code.php save code injection
- givanz Vvveb
- Other injection
- Code injection
- CVSS 5.3 Medium
givanz Vvveb session fixiation
- givanz Vvveb
- Authentication bypass