CVE-2026-39918Critical· 9.8▾ MidnightVvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject a…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.7%
Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parameter is written unsanitized into the env.php configuration file without escaping or validation. Attackers can inject arbitrary PHP code by breaking out of the string context in the define statement to achieve unauthenticated remote code execution as the web server user.
Vvveb < 1.0.8.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-34428High· 7.7Vvveb < 1.0.8.1 SSRF via oEmbedProxy
CVE-2026-34427High· 8.8Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
CVE-2026-34429Medium· 5.4Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename
CVE-2026-54612High· 8.8Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
CVE-2025-11027Low· 2.4A vulnerability was identified in givanz Vvveb up to 1.0.7.2
CVE-2026-41929Medium· 6.1Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor