Basant Kumar

**Name of the Vulnerable Software and Affected Versions** Tiptap for PHP versions prior to 2.1.1 **Description** An input validation issue allows authenticated attackers to cause a denial of service. By submitting Tiptap JSON where the `attrs.href` field is set as an array instead of a string, an unhandled TypeError is triggered in the `isAllowedUri()` function when the value is passed to `preg match()`. This allows attackers to persist malformed JSON records that permanently crash the server-side HTML rendering pipeline for all subsequent viewers of that record until the database entry is manually repaired. **Recommendations** Update Tiptap for PHP to version 2.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.3 **Description** A stored cross-site scripting issue exists in the customer signup flow. The `Signup::addUser()` controller copies raw POST `username` values into the `display name` field before sanitization. This allows attackers to submit HTML and script markup in the `username` field during signup; while the markup is stripped from the username column, it is persisted in the `display name` column. The script executes when the `display name` is rendered without encoding in vulnerable views. **Recommendations** Update Vvveb to version 1.0.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.3 **Description** An unrestricted file upload issue exists in the plugin upload endpoint. This allows users with super admin privileges to execute arbitrary PHP code by uploading a malicious plugin ZIP file. The attack involves crafting a ZIP archive containing a `plugin.php` file with a valid Slug header and a `public/index.php` file containing arbitrary PHP code. This code executes with the permissions of the web server user when accessed through unauthenticated HTTP requests to the public path of the plugin. **Recommendations** Update to version 1.0.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.3 **Description** An uncontrolled recursion issue exists in the admin controller dispatch cycle. The `Base::init()` function repeatedly invokes the `permission()` function on error handlers, leading to infinite recursion that exhausts PHP memory limits. A low-privilege user can trigger this by sending sustained requests to forbidden admin URLs, resulting in a denial of service for legitimate traffic by exhausting PHP memory across all workers. **Recommendations** Update to version 1.0.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.3 **Description** An information disclosure issue allows unauthenticated attackers to enumerate files and directories. This occurs because multiple paths lack proper index directives in .htaccess files, which are configuration files used by Apache web servers to control directory-level settings. Attackers can access admin asset paths, plugins, themes, and media folders to view filenames, file sizes, modification timestamps, and unrendered admin templates that contain sensitive route maps. **Recommendations** Update Vvveb to version 1.0.8.3 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An unauthenticated reflected cross-site scripting issue exists in the visual editor preview renderer. Attackers can execute arbitrary JavaScript by manipulating the `r` query parameter and ` component ajax` POST parameter. This occurs because the `isEditor()` function does not perform session, role, or token verification, and the view handler injects raw HTML POST body content without sanitization. Attackers can use a malicious link or an auto-submitted form to execute controlled JavaScript within the context of the Vvveb origin. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** A hard-coded credentials issue exists in the `docker-compose-apache.yaml` configuration. This allows unauthenticated attackers to access the bundled phpMyAdmin container using pre-configured database credentials. By connecting to the phpMyAdmin port, attackers can obtain unrestricted read and write access to the entire database, including administrator password hashes, customer personally identifiable information, and order data, which can lead to account takeover and data manipulation. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An unrestricted file upload issue exists in the media upload handler. Authenticated users with media-upload permissions can bypass extension restrictions by uploading a `.htaccess` file to map `.phtml` extensions to the PHP handler. This allows the upload of a `.phtml` file containing arbitrary PHP code, which can be executed by sending an unauthenticated HTTP GET request to the uploaded file, leading to remote code execution with web server privileges. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An XML external entity (XXE) injection issue exists in the admin Tools/Import feature. Authenticated `site admin` users can exploit the XML parser configuration in the 'system/import/xml.php' endpoint to inject `file://` or `php://filter` entity references. These references are resolved and persisted into the application database, allowing for arbitrary file disclosure and the overwriting of administrator password hashes to achieve privilege escalation. **Recommendations** Update to version 1.0.8.2 or later. As a temporary workaround, restrict access to the 'system/import/xml.php' endpoint.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** The admin code editor allows authenticated users with low privileges, such as editor, author, contributor, or site admin roles, to execute arbitrary code. This is possible due to insufficient file extension restrictions, enabling attackers to write a malicious `.htaccess` file to map arbitrary extensions to the PHP handler. Subsequently, PHP code can be uploaded using those extensions to achieve remote code execution when the file is accessed via HTTP. **Recommendations** Update to version 1.0.8.2 or later.

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.2 **Description** An information disclosure issue allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. By accessing the admin password-reset endpoint, a fatal error is triggered due to a missing namespace import. This exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler. **Recommendations** Update to version 1.0.8.2 or later.