CVE-2025-8518— givanz Vvveb Code Editor code.php save code injection
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-8518
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
givanz Vvveb Code Editor code.php save code injection
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vvveb 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vvveb是Givan个人开发者的一个强大且易于使用的CMS，用于构建网站、博客或电子商务商店。 Vvveb 1.0.5版本存在注入漏洞，该漏洞源于文件admin/controller/editor/code.php中函数Save的错误操作导致代码注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-8518
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | This repository contains a Proof of Concept (PoC) demonstrating a critical vulnerability in givanz Vvveb 1.0.5. The vulnerability allows an authenticated user with template editing privileges to write arbitrary PHP code to server files, leading to Remote Code Execution (RCE). | https://github.com/maestro-ant/Vvveb-CMS-CVE-2025-8518 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-8518
Please Login to view more intelligence information
Same Patch Batch · givanz · 2025-08-04 · 6 CVEs total
| CVE-2025-8517 | 6.3 MEDIUM | givanz Vvveb session fixiation |
| CVE-2025-8522 | 5.0 MEDIUM | givanz Vvvebjs node.js save.php path traversal |
| CVE-2025-8520 | 4.7 MEDIUM | givanz Vvveb Drag-and-Drop Editor editor server-side request forgery |
| CVE-2025-8519 | 2.7 LOW | givanz Vvveb Drag-and-Drop Editor editor information disclosure |
| CVE-2025-8521 | 2.4 LOW | givanz Vvveb Add Type post-types cross site scripting |
IV. Related Vulnerabilities
Same product: Vvveb
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same vendor: givanz
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same weakness: CWE-94
- CVE-2026-42298
Postiz: Arbitrary Code Execution and Token Exfiltration in p - CVE-2026-41486
Ray: Remote Code Execution via Parquet Arrow Extension Type - CVE-2026-41512
Remote code execution via JavaScript injection in `BrowserAu - CVE-2026-41507
Remote Code Execution (RCE) via String Literal Injection int - CVE-2026-44334
PraisonAI: Unauthenticated RCE via `tool_override.py`
V. Comments for CVE-2025-8518
No comments yet