CVE-2025-8975

givanz Vvveb edit.tpl cross site scripting

State: Published
Severity: 5.1 Medium
Published: Aug 14, 2025
Updated: Aug 14, 2025
Reserved: Aug 13, 2025

Description

A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the argument slug leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named 84c11d69df8452dc378feecd17e2a62ac10dac66. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
Vvvebgivanz	1.0.0Affected 1.0.1Affected 1.0.2Affected 1.0.3Affected 1.0.4Affected 1.0.5Affected 1.0.6Not affected

References

VDB-319971 | givanz Vvveb edit.tpl cross site scriptingvdb-entrytechnical-description
VDB-319971 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #628296 | Vvveb 1.0.5 Cross Site Scriptingthird-party-advisory
https://hkohi.ca/vulnerability/6related
https://gist.github.com/0xHamy/b2674eeffd1f73af96d29f152c47bcbdexploit
https://github.com/givanz/Vvveb/commit/84c11d69df8452dc378feecd17e2a62ac10dac66patch
https://github.com/givanz/Vvveb/releases/tag/1.0.6patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.