PT-2026-41359 · Vvveb · Vvveb

Published 2026-05-15 · Updated 2026-05-15 · CVE-2026-45622

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description An unauthenticated reflected cross-site scripting (XSS) issue exists in the public product return form. The customer order id POST parameter is inserted into an error message when an order lookup fails, and this message is rendered in the frontend template without HTML escaping. This allows attacker-controlled HTML or JavaScript to execute in the browser of the user who submits the form.

Recommendations Update to version 1.0.8.3.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-45622

GHSA-3XWM-8F6M-CFC6

Affected Products

Vvveb

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45622.json · Exploit
• 🔥 https://github.com/givanz/Vvveb/security/advisories/GHSA-3xwm-8f6m-cfc6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-45622 · Security Note
• https://osv.dev/vulnerability/CVE-2026-45622 · Vendor Advisory
• https://t.me/cveNotify/163698 · Telegram Post