CVE-2026-49223

{"id": "CVE-2026-49223", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49223", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-18T19:08:11.438646Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "givanz", "product": "Vvveb", "versions": [{"status": "affected", "version": "< 1.0.8.4"}]}]}], "published": "2026-08-18T17:16:57.830", "references": [{"url": "https://github.com/givanz/Vvveb/commit/3d5c15dcf4b50e4580161f05cb9e643d834d044a", "source": "security-advisories@github.com"}, {"url": "https://github.com/givanz/Vvveb/releases/tag/1.0.8.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc", "source": "security-advisories@github.com"}, {"url": "https://github.com/givanz/Vvveb/security/advisories/GHSA-cj37-c5m2-3jmc", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products. The admin/sql/sqlite/product_review.sql queries accept a caller-controlled product_review_id and do not verify product_review.product_id against product.admin_id for the current admin_id. An attacker can read pending review content, ratings, author information, and moderation state, change review status, edit review content, or delete reviews, manipulating product review visibility and integrity. This issue is fixed in version 1.0.8.4."}, {"lang": "es", "value": "Vvveb es un potente y f\u00e1cil de usar CMS con constructor de p\u00e1ginas para construir sitios web, blogs o tiendas de comercio electr\u00f3nico. Anteriormente a la 1.0.8.4, las operaciones de revisi\u00f3n de productos del backend de Vvveb permiten a un Vendedor con pocos privilegios gestionar rese\u00f1as de productos de otro Vendedor. Las consultas admin/sql/sqlite/product_review.sql aceptan un product_review_id controlado por el llamador y no verifican product_review.product_id contra product.admin_id para el admin_id actual. Un atacante puede leer el contenido de rese\u00f1as pendientes, calificaciones, informaci\u00f3n del autor y el estado de moderaci\u00f3n, cambiar el estado de la rese\u00f1a, editar el contenido de la rese\u00f1a o eliminar rese\u00f1as, manipulando la visibilidad y la integridad de las rese\u00f1as de productos. Este problema est\u00e1 solucionado en la versi\u00f3n 1.0.8.4."}], "lastModified": "2026-10-22T22:10:00.250", "sourceIdentifier": "security-advisories@github.com"}