Executive brief
Vvveb CMS is a content management system used for building websites, blogs, and online stores. A security flaw in its comment system allows unauthenticated visitors to submit malicious scripts disguised as a commenter's name. If a site administrator or another visitor interacts with the malicious comment, the attacker can execute code in their browser, potentially leading to account takeover, website defacement, or the theft of sensitive session information.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in Vvveb CMS prior to version 1.0.8.1 due to improper sanitization of the 'author' field during comment submission. An unauthenticated attacker can submit a payload that is stored in the database and later rendered unsanitized in two locations: the 'href' attribute of the author link in the admin moderation panel (Sink A) and the 'data-comment-author' attribute on the public post page (Sink B). In the public sink, the value is processed by a client-side JavaScript function ('replyTo') using '.innerHTML', allowing for arbitrary script execution when a user clicks the 'Reply' button. This allows for session hijacking and unauthorized actions in the context of both administrators and regular site visitors. The issue is resolved in version 1.0.8.1.
Affected products
- givanz Vvveb CMS < 1.0.8.1
Timeline
- 2026-05-04: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: NVD publication date