# cve.now: Givanz

The newest entries naming Givanz as an affected vendor (up to 200), of 57 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112905](https://cve.now/CVE-2026-112905.md): Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft (CVSS 9.0)
- [CVE-2026-110799](https://cve.now/CVE-2026-110799.md): Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover (CVSS 9.8)
- [CVE-2026-112904](https://cve.now/CVE-2026-112904.md): Vvveb: Path Traversal in nextRestore() and nextBackup() (CVSS 8.7)
- [CVE-2026-55232](https://cve.now/CVE-2026-55232.md): Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy (CVSS 7.6)
- [CVE-2026-55230](https://cve.now/CVE-2026-55230.md): Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character (CVSS 8.7)
- [CVE-2026-55231](https://cve.now/CVE-2026-55231.md): Vvveb: Path traversal in Vvveb via sanitizeFileName() bypass enables arbitrary file read and delete through backup tools (CVSS 7.2)
- [CVE-2026-54506](https://cve.now/CVE-2026-54506.md): Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field (CVSS 7.6)
- [CVE-2026-54612](https://cve.now/CVE-2026-54612.md): Vvveb: Authenticated editor path traversal to PHP file write/RCE via data-v-save-global (CVSS 8.8)
- [CVE-2026-54613](https://cve.now/CVE-2026-54613.md): Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter (CVSS 5.4)
- [CVE-2026-54507](https://cve.now/CVE-2026-54507.md): Vvveb oEmbedProxy vulnerable to server-side request forgery (CVSS 8.4)
- [CVE-2026-49223](https://cve.now/CVE-2026-49223.md): Vvveb product review authorization bypass allows Vendors to read, approve, edit, or delete reviews under other Vendors' products (CVSS 7.6)
- [CVE-2026-49224](https://cve.now/CVE-2026-49224.md): Vvveb post revision authorization bypass allows Authors to read, restore, or delete other Authors' post revisions (CVSS 8.3)
- [CVE-2026-49222](https://cve.now/CVE-2026-49222.md): Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products (CVSS 7.6)
- [CVE-2026-49225](https://cve.now/CVE-2026-49225.md): Vvveb product revision authorization bypass allows Vendors to read, restore, or delete other Vendors' product revisions (CVSS 8.3)
- [CVE-2026-49228](https://cve.now/CVE-2026-49228.md): Vvveb product authorization bypass allows Vendors to read, duplicate, or delete other Vendors' products (CVSS 8.8)
- [CVE-2026-49226](https://cve.now/CVE-2026-49226.md): Vvveb post authorization bypass allows Authors to view, duplicate, or delete other Authors' posts (CVSS 8.3)
- [CVE-2026-49227](https://cve.now/CVE-2026-49227.md): Vvveb comment authorization bypass allows Authors to read, approve, edit, or delete comments under other Authors' posts (CVSS 7.6)
- [CVE-2026-49221](https://cve.now/CVE-2026-49221.md): Vvveb digital asset authorization bypass allows Vendors to list, read, edit, or delete other Vendors' digital assets (CVSS 8.8)
- [CVE-2026-46408](https://cve.now/CVE-2026-46408.md): Vvveb: checkout IDOR allows unauthorized reuse of another user's cart (CVSS 7.6)
- [CVE-2026-46407](https://cve.now/CVE-2026-46407.md): Vvveb: admin/auth-token IDOR allows unauthorized disclosure of administrator REST API tokens (CVSS 8.1)
- [CVE-2026-45800](https://cve.now/CVE-2026-45800.md): Vvveb: Authenticated SQL injection in /user/orders via order\_by and direction (CVSS 8.7)
- [CVE-2026-45622](https://cve.now/CVE-2026-45622.md): Vvveb: Unauthenticated reflected XSS in public product return form via customer\_order\_id (CVSS 5.3)
- [CVE-2026-45616](https://cve.now/CVE-2026-45616.md): Vvveb: Stored XSS in Posts allows privilege escalation via post editor (CVSS 5.1)
- [CVE-2026-44826](https://cve.now/CVE-2026-44826.md): Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals (CVSS 7.5)
- [CVE-2026-44366](https://cve.now/CVE-2026-44366.md): Vvveb: Stored XSS via Comment Author Field (CVSS 6.1)
- [CVE-2026-41937](https://cve.now/CVE-2026-41937.md): Vvveb \< 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload (CVSS 8.6)
- [CVE-2026-41935](https://cve.now/CVE-2026-41935.md): Vvveb \< 1.0.8.3 Uncontrolled Recursion Denial of Service (CVSS 7.1)
- [CVE-2026-41933](https://cve.now/CVE-2026-41933.md): Vvveb \< 1.0.8.3 Directory Listing Information Disclosure (CVSS 6.9)
- [CVE-2026-41932](https://cve.now/CVE-2026-41932.md): Vvveb \< 1.0.8.3 Stored XSS via Signup Controller (CVSS 5.3)
- [CVE-2026-41928](https://cve.now/CVE-2026-41928.md): Vvveb \< 1.0.8.2 Information Disclosure via Cron Controller (CVSS 6.9)
- [CVE-2026-41929](https://cve.now/CVE-2026-41929.md): Vvveb \< 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor (CVSS 5.1)
- [CVE-2026-41938](https://cve.now/CVE-2026-41938.md): Vvveb \< 1.0.8.2 RCE via Media Upload Handler (CVSS 8.7)
- [CVE-2026-41930](https://cve.now/CVE-2026-41930.md): Vvveb \< 1.0.8.2 Hard-coded Credentials Information Disclosure via phpMyAdmin (CVSS 9.2)
- [CVE-2026-41931](https://cve.now/CVE-2026-41931.md): Vvveb \< 1.0.8.2 Information Disclosure via Debug Exception Handler (CVSS 6.9)
- [CVE-2026-41934](https://cve.now/CVE-2026-41934.md): Vvveb \< 1.0.8.2 Authenticated RCE via Code Editor (CVSS 8.7)
- [CVE-2026-41936](https://cve.now/CVE-2026-41936.md): Vvveb \< 1.0.8.2 XML External Entity Injection via Import (CVSS 8.6)
- [CVE-2026-39918](https://cve.now/CVE-2026-39918.md): Vvveb \< 1.0.8.1 Code Injection via Installation Endpoint (CVSS 9.2)
- [CVE-2026-34428](https://cve.now/CVE-2026-34428.md): Vvveb \< 1.0.8.1 SSRF via oEmbedProxy (CVSS 8.3)
- [CVE-2026-34427](https://cve.now/CVE-2026-34427.md): Vvveb \< 1.0.8.1 Privilege Escalation via admin/user/save (CVSS 8.7)
- [CVE-2026-34429](https://cve.now/CVE-2026-34429.md): Vvveb \< 1.0.8.1 Stored XSS via Media Upload and Rename (CVSS 5.1)
- [CVE-2026-5615](https://cve.now/CVE-2026-5615.md): givanz Vvvebjs File Upload Endpoint upload.php cross site scripting (CVSS 5.3)
- [CVE-2025-12203](https://cve.now/CVE-2025-12203.md): givanz Vvveb Code Editor functions.php sanitizeFileName path traversal (CVSS 5.3)
- [CVE-2025-11944](https://cve.now/CVE-2025-11944.md): givanz Vvveb Raw SQL import.php import sql injection (CVSS 5.1)
- [CVE-2025-11029](https://cve.now/CVE-2025-11029.md): givanz Vvveb cross-site request forgery (CVSS 5.3)
- [CVE-2025-11028](https://cve.now/CVE-2025-11028.md): givanz Vvveb Image information disclosure (CVSS 6.9)
- [CVE-2025-11027](https://cve.now/CVE-2025-11027.md): givanz Vvveb SVG File cross site scripting (CVSS 4.8)
- [CVE-2025-11026](https://cve.now/CVE-2025-11026.md): givanz Vvveb Configuration File information disclosure (CVSS 5.1)
- [CVE-2025-9728](https://cve.now/CVE-2025-9728.md): givanz Vvveb login.tpl cross site scripting (CVSS 5.3)
- [CVE-2025-9397](https://cve.now/CVE-2025-9397.md): givanz Vvveb media.php unrestricted upload (CVSS 5.3)
- [CVE-2025-8976](https://cve.now/CVE-2025-8976.md): givanz Vvveb Endpoint post cross site scripting (CVSS 5.1)
- [CVE-2025-8975](https://cve.now/CVE-2025-8975.md): givanz Vvveb edit.tpl cross site scripting (CVSS 5.1)
- [CVE-2025-8522](https://cve.now/CVE-2025-8522.md): givanz Vvvebjs node.js save.php path traversal (CVSS 2.3)
- [CVE-2025-8521](https://cve.now/CVE-2025-8521.md): givanz Vvveb Add Type post-types cross site scripting (CVSS 4.8)
- [CVE-2025-8520](https://cve.now/CVE-2025-8520.md): givanz Vvveb Drag-and-Drop Editor editor server-side request forgery (CVSS 5.1)
- [CVE-2025-8519](https://cve.now/CVE-2025-8519.md): givanz Vvveb Drag-and-Drop Editor editor information disclosure (CVSS 5.1)
- [CVE-2025-8518](https://cve.now/CVE-2025-8518.md): givanz Vvveb Code Editor code.php save code injection (CVSS 5.1)
- [CVE-2025-8517](https://cve.now/CVE-2025-8517.md): givanz Vvveb session fixiation (CVSS 5.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/givanz
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.