givanz Vvveb up to 1.0.8.4 User Profile profile.php sanitizeHTML user[bio] cross site scripting

Summaryinfo

A vulnerability was found in givanz Vvveb and classified as problematic. Affected by this vulnerability is the function sanitizeHTML of the file app/controller/user/profile.php of the component User Profile. Such manipulation of the argument user[bio] leads to cross site scripting. This vulnerability is traded as CVE-2026-54506. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in givanz Vvveb and classified as problematic. Affected by this issue is the function sanitizeHTML of the file app/controller/user/profile.php of the component User Profile. The manipulation of the argument user[bio] with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/user/profile.php accepts the user[bio] field and passes stored content through sanitizeHTML() in system/functions.php, whose on* event-handler regular expression omits the forward-slash delimiter and whose do-while condition compares the string to itself, so forbidden nested tags are removed only once. An Author-role or higher user can submit solidus-prefixed event-handler markup or nested forbidden tags that survive sanitization. The stored bio is rendered without sufficient output encoding on /author/{username}, in the admin user-management view, and potentially in comment displays, causing attacker-controlled JavaScript to execute when unauthenticated visitors, administrators, or other users view the content. This can expose browser-session data and permit victim-context account actions, defacement, or phishing. This issue is fixed in version 1.0.8.5.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54506 since 06/15/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

By approaching the search of inurl:app/controller/user/profile.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.0.8.5 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• givanz

Name

• Vvveb

Version

• 1.0.5
• 1.0.6
• 1.0.6.1
• 1.0.7
• 1.0.7.2
• 1.0.8
• 1.0.8.1
• 1.0.8.2
• 1.0.8.3
• 1.0.8.4

Website

• Product: https://github.com/givanz/Vvveb/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion