CVE-2025-11029

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

• CWE-352
• CWE-862
• CWE-352

• https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fceExploit
• https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423Exploit
• https://vuldb.com/?ctiid.325967Permissions Required, VDB Entry
• https://vuldb.com/?id.325967Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.657188Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.657190Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.657191Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.657192Third Party Advisory, VDB Entry
• https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fceExploit
• https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423Exploit

Published

Sep 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11023Inclusion of Functionality from Untrusted Control Sphere, Im…9.8
• CVE-2025-11024Improper neutralization of special elements used in an SQL c…9.8
• CVE-2025-11025Insertion of Sensitive Information Into Sent Data vulnerabil…5.3
• CVE-2025-11026A vulnerability was determined in givanz Vvveb up to 1.0.7.2…7.5
• CVE-2025-11027A vulnerability was identified in givanz Vvveb up to 1.0.7.2…5.4
• CVE-2025-11028A security flaw has been discovered in givanz Vvveb up to 1.…7.5
• CVE-2025-1103A vulnerability, which was classified as problematic, was fo…6.5
• CVE-2025-11030A vulnerability was detected in Tutorials-Website Employee M…7.3
• CVE-2025-11031A flaw has been found in DataTables up to 1.10.13. The affec…5.5
• CVE-2025-11032A flaw has been found in kidaze CourseSelectionSystem up to …9.8
• CVE-2025-11033A vulnerability has been found in kidaze CourseSelectionSyst…9.8
• CVE-2025-11034A vulnerability was found in Dibo Data Decision Making Syste…4.3