Repository navigation
Security: givanz/Vvveb
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
CSRF admin state-changing actions executable via GET without a tokenGHSA-grxp-rj92-j8xr published
Oct 29, 2026 by givanzModerate -
Stored XSS via sanitizeHTML() blacklist bypass (post/product content)GHSA-prqj-4768-vcmq published
Oct 29, 2026 by givanzModerate -
Authenticated RCE via `.sql` code injection in `editor/code/save`GHSA-2mq4-4q7r-q52q published
Oct 29, 2026 by givanzCritical -
SQL injection in admin auth-token save via array-key interpolation in Admin_Auth_TokenSQL::update()GHSA-ffrq-8926-cpc9 published
Oct 29, 2026 by givanzModerate -
Incomplete fix for CVE-2026-41934 (GHSA-vfjj-gcvv-w248) allows .tpl upload/rename via MediaTrait and bypasses isExecutableFile in editor/codeGHSA-7h6v-ww3f-24pp published
Oct 29, 2026 by givanzHigh -
Authorization bypass vulnerability in Vvveb post revisionsGHSA-7fg6-jfgq-56q9 published
Oct 29, 2026 by givanzModerate -
SQL injection via unfiltered array keys in @KEYS(:each) in the product and auth-token SQL templatesGHSA-fwp9-mpg4-hh5w published
Oct 29, 2026 by givanzModerate -
Cross-tenant digital-asset file tamper/delete in Vvveb ≤ 1.0.8.6 — unauthorized media actions via the shared storeGHSA-387r-2vfq-vrmf published
Oct 29, 2026 by givanzHigh -
Incomplete fix of CVE-2026-49226/49228: cross-user BOLA in Vvveb posts & products (list, duplicate, digital-asset list)GHSA-g7j8-g4xq-f232 published
Oct 29, 2026 by givanzModerate -
Cookie Forgery via PHP Type Juggling in generateCookie()GHSA-p8w8-2rq6-wm2g published
Oct 29, 2026 by givanzHigh
Learn more about advisories related to givanz/Vvveb in the GitHub Advisory Database