CVE-2025-8975
What it is
A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the argument slug leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named 84c11d69df8452dc378feecd17e2a62ac10dac66. It is recommended to upgrade the affected component.
At a glance
- Exploitability
- Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.
- Exploit odds
- 0.3% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.3% · EPSS, next 30 days
- Weakness
- CWE-79 · Cross-site scripting
- Record status
- Analyzed
Affected
- Vvveb < 1.0.6
Attack profile CVSS 4.0 · 2.0
- Attack vector
- Network
- Complexity
- Low
- Attack requirements
- None
- Privileges needed
- Low
- User interaction
- Passive
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix and advisories
- https://github.com/givanz/Vvveb/commit/84c11d69df8452dc378feecd17e2a62ac10dac66
- https://github.com/givanz/Vvveb/releases/tag/1.0.6
References
- https://gist.github.com/0xHamy/b2674eeffd1f73af96d29f152c47bcbd
- https://github.com/givanz/Vvveb/commit/84c11d69df8452dc378feecd17e2a62ac10dac66
- https://github.com/givanz/Vvveb/releases/tag/1.0.6
- https://hkohi.ca/vulnerability/6
- https://vuldb.com/?ctiid.319971
- https://vuldb.com/?id.319971
- https://vuldb.com/?submit.628296