CVE-2026-126374
Deferred Deferred - Pending Action

SQL Injection in Vvveb CMS via Product Save Feature

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126374
EUVD
EUVD-2026-125191

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
givanz Vvveb From 0 (inc) to 1.0.8.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126374 is an SQL injection vulnerability in Vvveb CMS versions 1.0.8.6 and earlier. The @KEYS(:each) macro outputs PHP array keys as backtick-quoted column names in SQL INSERT statements without escaping. Some procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql lack @FILTER protection. Authenticated back-office users with product-saving privileges can exploit this by submitting POST array keys containing backticks in product_<feature> fields to manipulate SQL queries.

Detection Guidance

To detect this vulnerability, inspect the Vvveb CMS installation for versions 1.0.8.6 or earlier. Check SQL templates in admin/sql/mysqli/product.sql and admin_auth_token.sql for missing @FILTER guards around @KEYS(:each) macros. Review POST requests handling product_<feature> fields for backtick characters in array keys.

Impact Analysis

This vulnerability allows authenticated back-office users to redirect bound values into unexposed columns or break SQL statements. Attackers can submit crafted POST data to control which columns receive specific values, including columns not exposed in forms. For example, an attacker could write a product ID into a points column. However, it does not allow direct data exfiltration or impact confidentiality or availability.

Mitigation Strategies

Immediately upgrade Vvveb to a patched version beyond 1.0.8.6. If upgrading is not possible, apply input validation to sanitize backticks in POST array keys for product_<feature> fields. Ensure all @KEYS(:each) macros in SQL templates are wrapped with @FILTER() to restrict keys to valid column names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...