XSS in Givanz Vvveb
CVE-2026-41932
Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the display_name field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the display_name column, allowing stored XSS execution when display_name is rendered without encoding in vulnerable views.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Givanz Vvveb — versions 0, fefac290a8c85d3c87fe80ffed68b6c5bc50e93c
Weakness classification (CWE)
References
- github.com/givanz/Vvveb/commit/fefac290a8c85d3c87fe80ffed68b6c5bc50e93c (patch)
- github.com/givanz/Vvveb/releases/tag/1.0.8.3 (release-notes)
- www.vulncheck.com/advisories/vvveb-stored-xss-via-signup-controller (third-party-advisory)
Frequently asked questions
- What is CVE-2026-41932?
- CVE-2026-41932 is a medium-severity vulnerability in Givanz Vvveb, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-05-14.
- How severe is CVE-2026-41932?
- Medium severity. CVSS v3 base score is 6.1 out of 10.