---
id: CVE-2026-110799
title: >-
  Vvveb: Authentication Bypass via PHP Array Injection leading to full Account
  Takeover
summary: >-
  Vvveb is a powerful and easy to use CMS with page builder to build websites,
  blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset
  functionality is vulnerable to an Authentication Bypass due to insufficient
  validation o…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-287
vendor: givanz
product: Vvveb
affected:
  - Vvveb < 1.0.8.7
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-30T15:48:21.184633Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:48:43.788Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110799'
references:
  - url: 'https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj'
    label: 'https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj'
tags:
  - cve.org
  - exploit-available
epss: 0.00708
epssPercentile: 0.53583
ingestedAt: '2026-11-05T16:07:30.479Z'
---

## Overview

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

## Affected

- `Vvveb < 1.0.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.