givanz Vvveb up to 1.0.8.3 Orders /user/orders OrderSQL::getAll sql injection

Summaryinfo

A vulnerability described as critical has been identified in givanz Vvveb up to 1.0.8.3. This issue affects the function OrderSQL::getAll of the file /user/orders of the component Orders Component. The manipulation results in sql injection. This vulnerability is identified as CVE-2026-45800. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in givanz Vvveb up to 1.0.8.3. It has been classified as critical. Affected is the function OrderSQL::getAll of the file /user/orders of the component Orders Component. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-45800 since 05/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 1.0.8.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-30582). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.8.0
• 1.0.8.1
• 1.0.8.2
• 1.0.8.3

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion