{"id":"CVE-2026-126369","kind":"vulnerability","aliases":["CVE-2026-126369"],"related":[],"title":"Vvveb: stored XSS lets low-privilege authors run script in admin sessions","description":"Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.","summary":"Vvveb through 1.0.8.6 fails to sanitize post and product content, so an author or vendor user can save markup that runs script in visitors' and admins' browsers. An attacker can use this to steal session cookies or CSRF tokens.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","self-hosted","vvveb"],"not_affected_if":["no-untrusted-authors"],"how_to_check":"- Check the installed Vvveb version against `1.0.8.6` or earlier.\n- Review whether untrusted users hold author or vendor roles in the admin panel.","fix":null,"status":"open","published_at":"2026-11-13T10:17:38+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:57:00+00:00","updated_at":"2026-11-13T10:57:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:57:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vvveb: stored XSS lets low-privilege authors run script in admin sessions","impact":"medium","summary":"Vvveb through 1.0.8.6 fails to sanitize post and product content, so an author or vendor user can save markup that runs script in visitors' and admins' browsers. An attacker can use this to steal session cookies or CSRF tokens.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","self-hosted","cms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs script in admin browsers and steals sessions.","analyst_note":"Confirm the fixed version and any patch at the vendor advisory on github.com and the VulnCheck entry.","how_to_check":"- Check the installed Vvveb version against `1.0.8.6` or earlier.\n- Review whether untrusted users hold author or vendor roles in the admin panel.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-authors"],"who_is_affected":"Sites running Vvveb through 1.0.8.6 where author or vendor accounts can save post or product content. Visitors and admins viewing that content are the targets. Sites without those roles, or on a later version, are likely not affected, but the sources do not confirm a fixed version.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4632,"output_tokens":516,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126369':16A,19A '-2026':15A,18A '1.0.8.6':28B,67C 'admin':12A,51B,118C 'allow':77C 'anonym':115C 'attack':54B,95C 'author':8A,38B,81C 'blacklist':92C 'browser':52B 'bypass':89C 'cms':20B 'contain':68C 'content':35B,101C 'cooki':61B 'cross':72C 'cross-sit':71C 'csrf':63B,123C 'csrf-token':122C 'cve':14A,17A 'enabl':119C 'entiti':110C 'event':105C 'event-handl':104C 'execut':112C 'fail':29B 'handler':106C 'host':24B 'inject':86C 'javascript':109C 'let':4A 'low':6A,79C 'low-privileg':5A,78C 'markup':44B 'packag':21B 'post':32B,98C 'privileg':7A,80C 'product':34B,100C 'regex':91C 'run':9A,46B 'sanit':31B 'sanitizehtml':94C 'save':43B,97C 'script':10A,47B,74C,87C,113C 'self':23B 'self-host':22B 'session':13A,60B,120C 'site':73C 'steal':59B 'store':2A,70C 'tag':107C 'theft':125C 'token':64B,124C 'unclos':103C 'use':56B 'user':41B,84C 'vendor':40B,83C 'visitor':49B,116C 'vulner':75C 'vvveb':1A,25B,26B,65C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running Vvveb through 1.0.8.6 where author or vendor accounts can save post or product content. Visitors and admins viewing that content are the targets. Sites without those roles, or on a later version, are likely not affected, but the sources do not confirm a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","package","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126369':16A,19A '-2026':15A,18A 'admin':12A 'author':8A 'cve':14A,17A 'let':4A 'low':6A 'low-privileg':5A 'privileg':7A 'run':9A 'script':10A 'session':13A 'store':2A 'vvveb':1A 'xss':3A","search_b":"'1.0.8.6':28B 'admin':51B 'attack':54B 'author':38B 'browser':52B 'cms':20B 'content':35B 'cooki':61B 'csrf':63B 'fail':29B 'host':24B 'markup':44B 'packag':21B 'post':32B 'product':34B 'run':46B 'sanit':31B 'save':43B 'script':47B 'self':23B 'self-host':22B 'session':60B 'steal':59B 'token':64B 'use':56B 'user':41B 'vendor':40B 'visitor':49B 'vvveb':25B,26B","search_c":"'1.0.8.6':67C 'admin':118C 'allow':77C 'anonym':115C 'attack':95C 'author':81C 'blacklist':92C 'bypass':89C 'contain':68C 'content':101C 'cross':72C 'cross-sit':71C 'csrf':123C 'csrf-token':122C 'enabl':119C 'entiti':110C 'event':105C 'event-handl':104C 'execut':112C 'handler':106C 'inject':86C 'javascript':109C 'low':79C 'low-privileg':78C 'post':98C 'privileg':80C 'product':100C 'regex':91C 'sanitizehtml':94C 'save':97C 'script':74C,87C,113C 'session':120C 'site':73C 'store':70C 'tag':107C 'theft':125C 'token':124C 'unclos':103C 'user':84C 'vendor':83C 'visitor':116C 'vulner':75C 'vvveb':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:14:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126369","severity":null,"published_at":"2026-11-13T10:17:38+00:00","modified_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144979,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-prqj-4768-vcmq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:14:15+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144980,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-stored-xss-via-sanitizehtml-blacklist-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}