CyberRota Analysis
AI-GeneratedVvveb CMS versions prior to 1.0.8.6 are vulnerable due to an inadequate HTML sanitizer that fails to remove event-handler attributes from tags containing a greater-than character. This flaw allows low-privilege content authors to inject malicious JavaScript, potentially leading to account takeover for both site visitors and administrators. Organizations using affected versions should prioritize updating to the patched version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HTML sanitizer fails to strip event-handler attributes when a tag carries a greater-than character inside a quoted attribute value. A low-privilege content author (default role author or contributor) can store a payload in post or product content that runs JavaScript in a browser of every visitor and of any administrator who views or previews that content, which opens a path to admin account takeover. This issue has been patched in version 1.0.8.6.