CVE-2026-45800 Details
Description
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The order_by and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.
An authenticated SQL injection vulnerability has been identified in Vvveb CMS versions prior to 1.0.8.3. The issue occurs on the frontend user order history page, specifically at the '/user/orders' endpoint. Normal frontend users can exploit this vulnerability by manipulating the 'order_by' and 'direction' request parameters. These parameters are directly concatenated into the SQL 'ORDER BY' clause without proper validation or sanitization, allowing attacker-controlled input to interfere with the SQL query execution.
Users are advised to update to Vvveb CMS version 1.0.8.3 or later. For those unable to update, a temporary workaround is to manually validate and sanitize the 'order_by' and 'direction' parameters before they are used in SQL queries.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 15, 2026CISA-ADP
Assessed May 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/givanz/Vvveb/security/advisories/GHSA-vwcx-w4fq-9769 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/givanz/Vvveb/security/advisories/GHSA-vwcx-w4fq-9769 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vvveb | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 16, 2026 | CVE Modified | CISA-ADP |
| May 15, 2026 | New CVE Received | [email protected] |