CVE-2026-34427High· 8.8▾ TwilightVvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile sa…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.6%
Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save requests to escalate to Super Administrator privileges, enabling plugin upload functionality for remote code execution.
Vvveb < 1.0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34428High· 7.7Vvveb < 1.0.8.1 SSRF via oEmbedProxy
CVE-2026-34429Medium· 5.4Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
CVE-2026-39918Critical· 9.8Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
CVE-2026-41929Medium· 6.1Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor
CVE-2026-41931Medium· 5.3Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler
CVE-2026-41930Critical· 9.8Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin