CVE-2026-34427— Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34427
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Vvveb < 1.0.8.1 Privilege Escalation via admin/user/save
Source: NVD (National Vulnerability Database)
Vulnerability Description
Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows authenticated users to modify privileged fields on their own profile. Attackers can inject role_id=1 into profile save requests to escalate to Super Administrator privileges, enabling plugin upload functionality for remote code execution.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-915
Source: NVD (National Vulnerability Database)
Vulnerability Title
Vvveb 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vvveb是Givan个人开发者的一个强大且易于使用的CMS，用于构建网站、博客或电子商务商店。 Vvveb 1.0.8.1之前版本存在安全漏洞，该漏洞源于管理员用户配置文件保存端点存在权限提升问题，可能导致攻击者提升至超级管理员权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-34427
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34427
Please Login to view more intelligence information
- Release Vvveb 1.0.8.1 · givanz/Vvveb · GitHubrelease-notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-34427
Same Patch Batch · givanz · 2026-04-20 · 4 CVEs total
| CVE-2026-39918 | 9.8 CRITICAL | Vvveb < 1.0.8.1 Code Injection via Installation Endpoint |
| CVE-2026-34428 | 7.7 HIGH | Vvveb < 1.0.8.1 SSRF via oEmbedProxy |
| CVE-2026-34429 | 5.4 MEDIUM | Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename |
IV. Related Vulnerabilities
Same product: Vvveb
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same vendor: givanz
- CVE-2026-41928
Vvveb < 1.0.8.2 Information Disclosure via Cron Controller - CVE-2026-41929
Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Edi - CVE-2026-41938
Vvveb < 1.0.8.2 RCE via Media Upload Handler - CVE-2026-41930
Vvveb < 1.0.8.2 Hard-coded Credentials Information Disclosur - CVE-2026-41931
Vvveb < 1.0.8.2 Information Disclosure via Debug Exception H
Same weakness: CWE-915
- CVE-2025-14341
Input Data Manipulation in DivvyDrive Information Technologi - CVE-2026-41139
Unsafe array index getter in mathjs - CVE-2026-33453
Apache Camel: CoAP URI Query Parameter to Exchange Header In - CVE-2026-42044
Axios: Invisible JSON Response Tampering via Prototype Pollu - CVE-2026-40897
Math.js: Unsafe object property setter in mathjs
V. Comments for CVE-2026-34427
No comments yet