CVE-2026-110799

Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover

State: Published
Severity: 9.8 Critical
Published: Oct 30, 2026
Updated: Oct 30, 2026
Reserved: Oct 14, 2026

Description

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
Vvvebgivanz	< 1.0.8.7Affected

References

https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.