givanz Vvveb up to 1.0.8.2 Negative Number quantity improper validation of specified quantity in input

Summaryinfo

A vulnerability marked as problematic has been reported in givanz Vvveb up to 1.0.8.2. This vulnerability affects unknown code of the component Negative Number Handler. The manipulation of the argument quantity leads to improper validation of specified quantity in input. This vulnerability is referenced as CVE-2026-44826. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in givanz Vvveb up to 1.0.8.2 and classified as problematic. This issue affects an unknown code of the component Negative Number Handler. The manipulation of the argument quantity with an unknown input leads to a improper validation of specified quantity in input vulnerability. Using CWE to declare the problem leads to CWE-1284. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties. Impacted is integrity. The summary by CVE is:

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-44826 since 05/07/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0.8.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.8.0
• 1.0.8.1
• 1.0.8.2

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion