cve.bz

givanz vvveb vulnerabilities, newest first, page 2

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 5.1CVE-2026-34429EPSS 0.3%

    Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to execute arbitrary JavaScript by bypassing MIME type validation and renaming uploaded fi…

  2. 8.3CVE-2026-34428EPSS 0.3%

    Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Aut…

  3. 8.7CVE-2026-34427EPSS 0.6%

    Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save…