CVE-2026-54507

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy() handler in admin/controller/editor/editor.php accepts an attacker-controlled url parameter and passes it to getUrl(), while validateUrl() in system/functions.php checks only the hostname string and does not validate its resolved addresses. An authenticated admin-panel user with editor/* permission can invoke GET /admin/index.php?module=editor/editor&action=oEmbedProxy with a dotted hostname or normalized loopback form that resolves to a private, loopback, link-local, or reserved address, causing the server to issue an HTTP or HTTPS request and return the response body. Storefront users and anonymous visitors cannot invoke the endpoint, but no CSRF token is required because the action uses GET. This can disclose internal service responses or cloud instance metadata and associated credentials. This issue is fixed in version 1.0.8.5.

• CWE-918

• https://github.com/givanz/Vvveb/commit/bd280f5ce136f6da22c873fb1eea9cad8741e623
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.5
• https://github.com/givanz/Vvveb/security/advisories/GHSA-xxp7-59p2-4jr8

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54501Browsertrix is a high-fidelity, browser-based crawling servi…9.4
• CVE-2026-54502Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54503plone.app.textfield provides a zope.schema-style field type …4.3
• CVE-2026-54504MCP Documentation Server is a local-first document managemen…8.8
• CVE-2026-54505TREK is a collaborative travel planner. Prior to 3.1.0, when…2
• CVE-2026-54506Vvveb is a powerful and easy to use CMS with page builder to…7.6
• CVE-2026-54508TREK is a collaborative travel planner. Prior to 3.1.0, TREK…5.3
• CVE-2026-54509TREK is a collaborative travel planner. From 3.0.0 until 3.1…6.5
• CVE-2026-5451The Extensions for Leaflet Map plugin for WordPress is vulne…6.4
• CVE-2026-54510Speakr is a personal, self-hosted web application designed f…7.1
• CVE-2026-54511LogTape is an unobtrusive logging library. Prior to 1.3.11, …8.6
• CVE-2026-54512jackson-databind contains the general-purpose data-binding f…8.1