https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T13:40:35.460737+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-58jr-p6xx-mm8m GHSA-58jr-p6xx-mm8m 2026-11-13T13:40:35.461842+00:00

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.