Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin

Vvveb < 1.0.8.1 Code Injection via Installation Endpoint

givanz Vvveb media.php unrestricted upload

Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products

Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets

Vvveb < 1.0.8.2 RCE via Media Upload Handler

Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save

givanz Vvveb cross-site request forgery

Vvveb: Path Traversal in nextRestore() and nextBackup()

Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character

Vvveb: Authenticated SQL injection in /user/orders via order_by and direction

Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions

Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions

Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb < 1.0.8.1 SSRF via oEmbedProxy

Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts

Vvveb: checkout IDOR allows unauthorized reuse of another user's cart

Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals

givanz Vvveb Image information disclosure

givanz Vvveb Configuration File information disclosure

Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

givanz Vvveb Code Editor code.php save code injection

Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service

givanz Vvveb session fixiation

Vvveb: Stored XSS via Comment Author Field

Vvveb < 1.0.8.3 Stored XSS via Signup Controller

Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor

givanz Vvveb login.tpl cross site scripting

Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter

Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename

givanz Vvveb SVG File cross site scripting

givanz Vvveb Endpoint post cross site scripting

givanz Vvveb edit.tpl cross site scripting

givanz Vvveb Add Type post-types cross site scripting

Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id

Vvveb < 1.0.8.3 Directory Listing Information Disclosure

Vvveb < 1.0.8.2 Information Disclosure via Cron Controller

Vvveb < 1.0.8.2 Information Disclosure via Debug Exception Handler

Vvveb: Stored XSS in Posts allows privilege escalation via post editor

givanz Vvveb Drag-and-Drop Editor editor server-side request forgery