Quick answers
- Is CVE-2026-45800 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45800 being exploited in the wild.
- How severe is CVE-2026-45800?
- Informational severity, with a CVSS score of 8.7, published 15 May 2026.
- Which products and versions are affected?
- Givanz Vvveb CMS < 1.0.8.3.
- Is there a fix for CVE-2026-45800?
- A patch was published on 2026-05-15: Vulnerability fixed in version 1.0.8.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45800 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45800?
- Check whether you run Givanz Vvveb CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authenticated SQL injection vulnerability exists in Vvveb CMS prior to version 1.0.8.3. The vulnerability is located in the frontend user order history page (/user/orders), where the 'order_by' and 'direction' request parameters are accepted from the URL and passed to the Orders component. These parameters are then directly concatenated into the SQL ORDER BY clause within the OrderSQL::getAll() method in storage/model/app/ordersql.mysqli.php without proper whitelisting or sanitization. A registered frontend user can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise. The issue is resolved in version 1.0.8.3 by implementing stricter input validation.
Affected products
- givanz Vvveb CMS < 1.0.8.3
Timeline
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-15: disclosed: CVE published to NVD
- 2026-05-15: patched: Vulnerability fixed in version 1.0.8.3