CVE-2026-41929
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Vvveb before version 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer. Attackers can exploit the 'r' query parameter and '_component_ajax' POST parameter to inject and execute arbitrary JavaScript in the context of the Vvveb origin.
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions within the Vvveb application without requiring authentication.
Recommendation
Immediately update Vvveb to version 1.0.8.2 or later. Until the update is applied, restrict access to the visual editor and implement input validation.
Original NVD description (English source)
Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and _component_ajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.