CVE-2026-34427: high-severity vulnerability in givanz Vvveb
Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.6%
Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save requests to escalate to Super Administrator privileges, enabling plugin upload functionality for remote code execution.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
givanz · VvvebRelated CVEs — givanz Vvveb
In the same product, most dangerous first.
CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.6%CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.5%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%