Live › vulnerability › CVE-2026-110799
Vvveb is a content management system for building websites, blogs and stores. Before version 1.0.8.7, weak checks on the user and token parameters of its password reset flow let an attacker bypass authentication.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Any site running Vvveb before 1.0.8.7 with the password reset feature reachable is exposed, since the flaw sits in the reset flow's parameter validation. Sites that do not run Vvveb, or run 1.0.8.7 or later, are not affected. Whether the reset feature must be enabled or reachable from the internet is unknown from the sources.
No product ranges from the sources yet.
1.0.8.7.1.0.8.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-110799")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.