QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-41932

Back to search

CVE-2026-41932

Published: May 14, 2026

Modified: May 14, 2026

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the display_name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display_name column, allowing stored XSS execution when display_name is rendered without encoding in vulnerable views.

VendorProductVersions

givanz

Vvveb

affected
0 - < 1.0.8.3
unaffected
fefac290a8c85d3c87fe80ffed68b6c5bc50e93c

Weaknesses (CWE)

CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now