A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of the argument Email/Password leads to cross site scripting. The attack can be executed remotely. The name of the patch is bbd4c42c66ab818142240348173a669d1d2537fe. Applying a patch is advised to resolve this issue.
Fix
Public exploits 1
- helloandrewpaul/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 1
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · vvvebNVD modified 2026-10-18 21:10
Affected (CPE criteria) 1
cpe:2.3:a:vvveb:vvveb:1.0.7.2:*:*:*:*:*:*:*
References 8
- https://github.com/givanz/Vvveb/commit/bbd4c42c66ab818142240348173a669d1d2537fe Patch
- https://github.com/givanz/Vvveb/issues/323 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/kwerty138/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 Exploit, Third Party Advisory
- https://vuldb.com/?ctiid.322017 Permissions Required, VDB Entry
- https://vuldb.com/?id.322017 Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.639704 Third Party Advisory, VDB Entry
- https://github.com/givanz/Vvveb/issues/323 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/kwerty138/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 Exploit, Third Party Advisory