# Vvveb vulnerabilities Source: https://junglewise.ai/threats/technologies/vvveb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/vvveb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 13 vulnerabilities in Vvveb: 0 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110799, was published on 30 October 2026. 2 vulnerabilities in the last four weeks, down 71% on the four before (7). 1 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 9 - All time: 13 (1 critical, 0 exploited in the wild) ## About Vvveb Open-source drag-and-drop website builder and content management system. ## Latest Vvveb vulnerabilities - [CVE-2026-110799: Vvveb CMS authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-110799-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (critical, CVSS 9.8, published 30 Oct 2026) - [CVE-2026-112904: Vvveb path traversal in backup functions](https://junglewise.ai/threats/cve-2026-112904-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 8.7, published 23 Oct 2026) - [CVE-2026-55232: Vvveb SSRF via IPv6 bypass in oEmbed proxy](https://junglewise.ai/threats/cve-2026-55232-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 7.6, published 1 Oct 2026) - [CVE-2026-55231: Vvveb CMS path traversal in sanitizeFileName](https://junglewise.ai/threats/cve-2026-55231-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 7.2, published 1 Oct 2026) - [CVE-2026-55230: Vvveb stored XSS via HTML sanitizer filter bypass](https://junglewise.ai/threats/cve-2026-55230-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 8.7, published 1 Oct 2026) - [CVE-2026-54613: Vvveb path traversal in backup file handling via theme parameter](https://junglewise.ai/threats/cve-2026-54613-vvveb-path-traversal-in-backup-file-handling-via-theme-parameter) (medium, CVSS 5.4, published 17 Sep 2026) - [CVE-2026-54612: Vvveb CMS arbitrary file write and PHP execution](https://junglewise.ai/threats/cve-2026-54612-vvveb-cms-arbitrary-file-write-and-php-execution) (high, CVSS 8.8, published 17 Sep 2026) - [CVE-2026-54507: Vvveb oEmbedProxy SSRF in editor handler](https://junglewise.ai/threats/cve-2026-54507-vvveb-oembedproxy-ssrf-in-editor-handler) (info, CVSS 6.5, published 17 Sep 2026) - [CVE-2026-54506: Vvveb CMS stored XSS in user bio](https://junglewise.ai/threats/cve-2026-54506-vvveb-cms-stored-xss-in-user-bio) (high, CVSS 7.6, published 17 Sep 2026) - [CVE-2026-41935: Vvveb uncontrolled recursion in admin controller dispatch cycle](https://junglewise.ai/threats/cve-2026-41935-vvveb-uncontrolled-recursion-in-admin-controller-dispatch-cycle) (high, CVSS 7.1, published 14 May 2026) - [CVE-2026-41933: Givanz Vvveb directory listing information disclosure](https://junglewise.ai/threats/cve-2026-41933-givanz-vvveb-directory-listing-information-disclosure) (medium, CVSS 5.3, published 14 May 2026) - [CVE-2025-12203: A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file…](https://junglewise.ai/threats/cve-2025-12203-a-weakness-has-been-identified-in-givanz-vvveb-up-to-1-0-7-3-this) (medium, CVSS 6.3, published 27 Oct 2025) - [CVE-2025-11944: A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file…](https://junglewise.ai/threats/cve-2025-11944-a-vulnerability-was-determined-in-givanz-vvveb-up-to-1-0-7-3-this) (medium, CVSS 4.7, published 19 Oct 2025) ## Most severe Vvveb vulnerabilities - [CVE-2026-110799: Vvveb CMS authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-110799-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (critical, CVSS 9.8, published 30 Oct 2026) - [CVE-2026-54612: Vvveb CMS arbitrary file write and PHP execution](https://junglewise.ai/threats/cve-2026-54612-vvveb-cms-arbitrary-file-write-and-php-execution) (high, CVSS 8.8, published 17 Sep 2026) - [CVE-2026-55230: Vvveb stored XSS via HTML sanitizer filter bypass](https://junglewise.ai/threats/cve-2026-55230-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 8.7, published 1 Oct 2026) - [CVE-2026-112904: Vvveb path traversal in backup functions](https://junglewise.ai/threats/cve-2026-112904-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 8.7, published 23 Oct 2026) - [CVE-2026-55232: Vvveb SSRF via IPv6 bypass in oEmbed proxy](https://junglewise.ai/threats/cve-2026-55232-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 7.6, published 1 Oct 2026) - [CVE-2026-54506: Vvveb CMS stored XSS in user bio](https://junglewise.ai/threats/cve-2026-54506-vvveb-cms-stored-xss-in-user-bio) (high, CVSS 7.6, published 17 Sep 2026) - [CVE-2026-55231: Vvveb CMS path traversal in sanitizeFileName](https://junglewise.ai/threats/cve-2026-55231-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (high, CVSS 7.2, published 1 Oct 2026) - [CVE-2026-41935: Vvveb uncontrolled recursion in admin controller dispatch cycle](https://junglewise.ai/threats/cve-2026-41935-vvveb-uncontrolled-recursion-in-admin-controller-dispatch-cycle) (high, CVSS 7.1, published 14 May 2026) - [CVE-2025-12203: A weakness has been identified in givanz Vvveb up to 1.0.7.3. This issue affects the function sanitizeFileName of the file…](https://junglewise.ai/threats/cve-2025-12203-a-weakness-has-been-identified-in-givanz-vvveb-up-to-1-0-7-3-this) (medium, CVSS 6.3, published 27 Oct 2025) - [CVE-2026-54613: Vvveb path traversal in backup file handling via theme parameter](https://junglewise.ai/threats/cve-2026-54613-vvveb-path-traversal-in-backup-file-handling-via-theme-parameter) (medium, CVSS 5.4, published 17 Sep 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, down 71% on the four before (7). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 3 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 1 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Vvveb technologies - [Vvvebjs](https://junglewise.ai/threats/technologies/vvveb-vvvebjs): 4 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Vvveb vulnerabilities", https://junglewise.ai/threats/technologies/vvveb, 11 November 2026.