PT-2026-30559 · Givanz · Givanz Vvveb

Ethx0 · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5615

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions givanz Vvvebjs versions up to 2.0.5

Description A weakness exists in givanz Vvvebjs up to version 2.0.5 related to the File Upload Endpoint, specifically within the upload.php file. Manipulation of the uploadAllowExtensions argument can lead to cross site scripting. Remote exploitation is possible. The exploit has been made publicly available.

Recommendations Apply patch 8cac22cff99b8bc701c408aa8e887fa702755336.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-5615

Affected Products

Givanz Vvveb

References · 10

• 🔥 https://tcn60zf28jhk.feishu.cn/wiki/Cr4KwMPiMi65fFkI9Vyc3oX2n0f?from=from_copylink · Exploit
• https://github.com/givanz/VvvebJs/commit/8cac22cff99b8bc701c408aa8e887fa702755336 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5615 · Security Note
• https://github.com/givanz/VvvebJs · Note
• https://vuldb.com/submit/785563 · Note
• https://twitter.com/pdnuclei_bot/status/2041199294112481330 · Twitter Post
• https://vuldb.com/vuln/355406 · Note
• https://twitter.com/CVEnew/status/2040998346685550765 · Twitter Post
• https://vuldb.com/vuln/355406/cti · Note
• https://twitter.com/infoflowcloud/status/2040999349153300878 · Twitter Post