Givanz vulnerabilities
57 CVEs and advisories name Givanz as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-112905Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft
- CVE-2026-110799Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover
- CVE-2026-112904Vvveb: Path Traversal in nextRestore() and nextBackup()
- CVE-2026-55232Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy
- CVE-2026-55230Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
- CVE-2026-55231Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools
- CVE-2026-54506Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
- CVE-2026-54612Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global
- CVE-2026-54613Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter
- CVE-2026-54507Vvveb oEmbedProxy vulnerable to server-side request forgery
- CVE-2026-49223Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products
- CVE-2026-49224Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions
- CVE-2026-49222Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products
- CVE-2026-49225Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions
- CVE-2026-49228Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products
- CVE-2026-49226Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts
- CVE-2026-49227Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts
- CVE-2026-49221Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets
- CVE-2026-46408Vvveb: checkout IDOR allows unauthorized reuse of another user's cart
- CVE-2026-46407Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens
- CVE-2026-45800Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
- CVE-2026-45622Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id
- CVE-2026-45616Vvveb: Stored XSS in Posts allows privilege escalation via post editor
- CVE-2026-44826Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals
- CVE-2026-44366Vvveb: Stored XSS via Comment Author Field
- CVE-2026-41937Vvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload
- CVE-2026-41935Vvveb < 1.0.8.3 Uncontrolled Recursion Denial of Service
- CVE-2026-41933Vvveb < 1.0.8.3 Directory Listing Information Disclosure
- CVE-2026-41932Vvveb < 1.0.8.3 Stored XSS via Signup Controller
- CVE-2026-41928Vvveb < 1.0.8.2 Information Disclosure via Cron Controller