A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.1 · vvvebNVD modified 2026-10-09 10:10
Affected (CPE criteria) 1
cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*
References 10
- https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fce Exploit
- https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423 Exploit
- https://vuldb.com/?ctiid.325967 Permissions Required, VDB Entry
- https://vuldb.com/?id.325967 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.657188 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.657190 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.657191 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.657192 Third Party Advisory, VDB Entry
- https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fce Exploit
- https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423 Exploit