PT-2026-40941 · Givanz+1 · Vvveb

Basant Kumar + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-41932

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description A stored cross-site scripting issue exists in the customer signup flow. The Signup::addUser() controller copies raw POST username values into the display name field before sanitization. This allows attackers to submit HTML and script markup in the username field during signup; while the markup is stripped from the username column, it is persisted in the display name column. The script executes when the display name is rendered without encoding in vulnerable views.

Recommendations Update Vvveb to version 1.0.8.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41932

Affected Products

Vvveb

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41932.json · Exploit
• https://github.com/givanz/Vvveb/commit/fefac290a8c85d3c87fe80ffed68b6c5bc50e93c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41932 · Security Note
• https://osv.dev/vulnerability/CVE-2026-41932 · Vendor Advisory
• https://github.com/givanz/Vvveb · Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 · Note
• https://vulncheck.com/advisories/vvveb-stored-xss-via-signup-controller · Note