https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-13T13:55:48.729412+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126372 CVE-2026-126372 — Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code 2026-11-13T13:55:48.733003+00:00

Affected: givanz Vvveb

Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename actions, or evade isExecutableFile checks in save(), to inject PHP code into templates.