{"id":"CVE-2026-126371","kind":"vulnerability","aliases":["CVE-2026-126371"],"related":[],"title":"Vvveb: admin token save lets authenticated users inject SQL","description":"Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can submit backtick-containing keys to the admin/auth-token save action to inject comments and column identifiers into the SQL statement.","summary":"Vvveb through 1.0.8.6 builds an INSERT statement from admin-supplied array keys without whitelisting or escaping them. An authenticated admin-panel user can inject SQL comments and column identifiers into the query.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","vvveb"],"not_affected_if":["auth-required","no-untrusted-admins"],"how_to_check":"- Check the installed Vvveb version against `1.0.8.6`\n- Look for `Admin_Auth_TokenSQL::update()` in the Vvveb source and see whether admin_auth_token keys are whitelisted or backtick-escaped","fix":null,"status":"open","published_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","triaged_at":"2026-11-13T10:57:00+00:00","updated_at":"2026-11-13T10:57:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:57:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Vvveb: admin token save lets authenticated users inject SQL","impact":"medium","summary":"Vvveb through 1.0.8.6 builds an INSERT statement from admin-supplied array keys without whitelisting or escaping them. An authenticated admin-panel user can inject SQL comments and column identifiers into the query.","audience":"businesses","category":"package","nicknames":[],"who_cares":["vvveb","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated admin injects SQL to read or alter database","analyst_note":"Confirm the fixed Vvveb version and whether the admin/auth-token save action is exposed in default installs, using the NVD and vendor advisory linked in the sources.","how_to_check":"- Check the installed Vvveb version against `1.0.8.6`\n- Look for `Admin_Auth_TokenSQL::update()` in the Vvveb source and see whether admin_auth_token keys are whitelisted or backtick-escaped","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-untrusted-admins"],"who_is_affected":"Teams running Vvveb 1.0.8.6 or earlier with admin panel access. Only logged-in admin-panel users can reach the flawed save action, so exposure depends on who holds admin accounts. Installations on newer versions or without admin panel exposure can skip it, but the sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4645,"output_tokens":568,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126371':12A,15A '-2026':11A,14A '1.0.8.6':24B,58C 'action':103C 'admin':2A,31B,43B,65C,71C,90C 'admin-panel':42B,89C 'admin-suppli':30B 'admin/auth-token':101C 'array':33B,74C 'auth':66C,72C 'authent':6A,41B,88C 'backtick':86C,96C 'backtick-contain':95C 'build':25B 'column':51B,79C,83C,108C 'comment':49B,106C 'contain':59C,97C 'cve':10A,13A 'escap':38B,87C 'host':20B 'identifi':52B,109C 'inject':8A,47B,62C,105C 'insert':27B,78C 'interpol':70C 'key':34B,75C,98C 'let':5A 'list':80C 'packag':16B 'panel':44B,91C 'php':17B 'queri':55B 'save':4A,102C 'self':19B 'self-host':18B 'sql':9A,48B,61C,112C 'statement':28B,113C 'submit':94C 'suppli':32B 'token':3A,73C 'tokensql':67C 'updat':68C 'user':7A,45B,92C 'vulner':63C 'vvveb':1A,21B,22B,56C 'whitelist':36B,84C 'without':35B,81C","nicknames":[],"mitigations":[],"who_affected":"Teams running Vvveb 1.0.8.6 or earlier with admin panel access. Only logged-in admin-panel users can reach the flawed save action, so exposure depends on who holds admin accounts. Installations on newer versions or without admin panel exposure can skip it, but the sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","selfhosted","vvveb"],"campaign_type":null,"search_a":"'-126371':12A,15A '-2026':11A,14A 'admin':2A 'authent':6A 'cve':10A,13A 'inject':8A 'let':5A 'save':4A 'sql':9A 'token':3A 'user':7A 'vvveb':1A","search_b":"'1.0.8.6':24B 'admin':31B,43B 'admin-panel':42B 'admin-suppli':30B 'array':33B 'authent':41B 'build':25B 'column':51B 'comment':49B 'escap':38B 'host':20B 'identifi':52B 'inject':47B 'insert':27B 'key':34B 'packag':16B 'panel':44B 'php':17B 'queri':55B 'self':19B 'self-host':18B 'sql':48B 'statement':28B 'suppli':32B 'user':45B 'vvveb':21B,22B 'whitelist':36B 'without':35B","search_c":"'1.0.8.6':58C 'action':103C 'admin':65C,71C,90C 'admin-panel':89C 'admin/auth-token':101C 'array':74C 'auth':66C,72C 'authent':88C 'backtick':86C,96C 'backtick-contain':95C 'column':79C,83C,108C 'comment':106C 'contain':59C,97C 'escap':87C 'identifi':109C 'inject':62C,105C 'insert':78C 'interpol':70C 'key':75C,98C 'list':80C 'panel':91C 'save':102C 'sql':61C,112C 'statement':113C 'submit':94C 'token':73C 'tokensql':67C 'updat':68C 'user':92C 'vulner':63C 'vvveb':56C 'whitelist':84C 'without':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T01:16:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126371","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126371","severity":null,"published_at":"2026-11-13T10:17:39+00:00","modified_at":"2026-11-13T10:17:39+00:00","first_seen_at":"2026-11-13T10:47:17+00:00","fetched_at":"2026-11-13T10:47:17+00:00","note":null}],"documents":[{"id":144983,"url":"https://github.com/givanz/Vvveb/security/advisories/GHSA-ffrq-8926-cpc9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T01:16:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144984,"url":"https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-admin-auth-tokensql-update-array-keys","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}