givanz Vvveb up to 1.0.8.3 Product Revisions revisions.php product_id/language_id/created_at privileges management

Summaryinfo

A vulnerability labeled as critical has been found in givanz Vvveb. This affects an unknown function of the file admin/controller/product/revisions.php of the component Product Revisions. Executing a manipulation of the argument product_id/language_id/created_at can lead to privileges management. This vulnerability appears as CVE-2026-49225. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in givanz Vvveb and classified as critical. This vulnerability affects an unknown part of the file admin/controller/product/revisions.php of the component Product Revisions. The manipulation of the argument product_id/language_id/created_at with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49225 since 05/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

By approaching the search of inurl:admin/controller/product/revisions.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.8.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1
• 1.0.8.2
• 1.0.8.3

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion