CVE-2025-8518mediumCWE-74CWE-94

CVE-2025-8518: falha de média gravidade em givanz Vvveb

givanz Vvveb Code Editor code.php save code injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vvveb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 5.1epss 2.6%
da publicação à armano mesmo dia
Publicada no NVD4 de ago.
metasploit10 de jan.
A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
givanz · Vvveb
CVEs relacionadas — givanz Vvveb

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.5%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%CVE-2025-11028MEDIUMgivanz Vvveb Image information disclosureEPSS 0.6%