CVE-2026-112905criticalCWE-285

CVE-2026-112905: falha crítica em givanz Vvveb

Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Vvveb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9epss 0.5%
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, authenticated IDOR on admin/auth-token endpoint allows any administrator to read and overwrite another administrator's API tokens. This issue has been patched in version 1.0.8.7.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Produtos afetados
givanz · Vvveb
CVEs relacionadas — givanz Vvveb

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8518MEDIUMgivanz Vvveb Code Editor code.php save code injectionEPSS 2.6%CVE-2025-8517MEDIUMgivanz Vvveb session fixiationEPSS 2.5%CVE-2026-54612HIGHVvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-globalEPSS 0.8%CVE-2026-41938HIGHVvveb < 1.0.8.2 RCE via Media Upload HandlerEPSS 0.7%CVE-2026-110799CRITICALVvveb: Authentication Bypass via PHP Array Injection leading to full Account TakeoverEPSS 0.7%CVE-2026-39918CRITICALVvveb < 1.0.8.1 Code Injection via Installation EndpointEPSS 0.7%