CVE-2026-110799criticalCWE-287

CVE-2026-110799: falha crítica em givanz Vvveb

Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover

Publicada em

Seguir esta CVE+ Monitorar Vvveb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.7%
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
givanz · Vvveb
CVEs relacionadas — givanz Vvveb

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.3%CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.3%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%CVE-2025-11028MEDIUMgivanz Vvveb Image information disclosureEPSS 0.6%