CVE-2026-34428High· 7.7▾ TwilightVvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. A…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/editor module where the url parameter is passed directly to getUrl() via curl without scheme or destination validation. Authenticated backend users can supply file:// URLs to read arbitrary files readable by the web server process or http:// URLs targeting internal network addresses to probe internal services, with response bodies returned directly to the caller.
Vvveb < 1.0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34427High· 8.8Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
CVE-2026-34429Medium· 5.4Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
CVE-2026-39918Critical· 9.8Vvveb < 1.0.8.1 Code Injection via Installation Endpoint
CVE-2026-55232High· 7.6Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-54507High· 8.4Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2026-41929Medium· 6.1Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor