Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global

Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products

Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets

Vvveb < 1.0.8.2 RCE via Media Upload Handler

Vvveb < 1.0.8.2 Authenticated RCE via Code Editor

Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save

givanz Vvveb cross-site request forgery

Vvveb: Path Traversal in nextRestore() and nextBackup()

Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character

Vvveb: Authenticated SQL injection in /user/orders via order_by and direction

Vvveb oEmbedProxy vulnerable to server-side request forgery

Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions

Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions

Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts

Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens

Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb < 1.0.8.1 SSRF via oEmbedProxy

Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy

Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field

Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products

Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts

Vvveb: checkout IDOR allows unauthorized reuse of another user's cart

Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals

givanz Vvveb Image information disclosure

givanz Vvveb Configuration File information disclosure

Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools

Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload

givanz Vvveb Code Editor code.php save code injection

Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service