CVE-2026-126371 · Package
NO FIX YET
Vvveb through 1.0.8.6 builds an INSERT statement from admin-supplied array keys without whitelisting or escaping them. An authenticated admin-panel user can inject SQL comments and column identifiers into the query.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Vvveb 1.0.8.6 or earlier with admin panel access. Only logged-in admin-panel users can reach the flawed save action, so exposure depends on who holds admin accounts. Installations on newer versions or without admin panel exposure can skip it, but the sources do not name a fixed version.
Not affected if auth-required, no-untrusted-admins
Who cares php, self-hosted, vvveb
1.0.8.6Admin_Auth_TokenSQL::update() in the Vvveb source and see whether admin_auth_token keys are whitelisted or backtick-escapedNo fix yet, per the sources.
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.