CVE-2026-110799
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce…
- Risk score
- 64/100
- CVSS
- 9.8 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Vvveb CMS has a critical vulnerability in password reset functionality due to insufficient validation of user and token GET parameters, allowing attackers to bypass authentication. An attacker could exploit this to gain high-level access, including reading, modifying, and deleting data, as well as performing unauthorized actions.
- Affected
- {'product': 'Vvveb', 'packages': [], 'versions': 'prior to 1.0.8.7'}
- Fix
- Upgrade to version 1.0.8.7 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.
Last activity 30 Oct 2026. Patch Forecast updates every hour.