CVE-2025-11027: fallo de gravedad media en givanz Vvveb
givanz Vvveb SVG File cross site scripting
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.3%
A vulnerability was identified in givanz Vvveb up to 1.0.7.2. Affected by this issue is some unknown functionality of the component SVG File Handler. Such manipulation leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Productos afectados
givanz · VvvebCVEs relacionadas — givanz Vvveb
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.6%CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.5%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%