Description
A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of the argument Email/Password leads to cross site scripting. The attack can be executed remotely. The name of the patch is bbd4c42c66ab818142240348173a669d1d2537fe. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| givanz | Vvveb | 1.0.7.2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
helloandrewpaul/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 ★ 0 · Aug 22, 2025
CVE-2025-9728: Reflected XSS in Login Form (Email & Password Fields) Vvveb CMS v1.0.7.2
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- VDB-322017 | givanz Vvveb login.tpl cross site scripting vdb-entry technical-description
- VDB-322017 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #639704 | givanz Vvveb 1.0.7.2 Cross Site Scripting third-party-advisory
- https://github.com/kwerty138/Reflected-XSS-in-Vvveb-CMS-v1.0.7.2 related
- https://github.com/givanz/Vvveb/issues/323 issue-tracking
- https://github.com/givanz/Vvveb/commit/bbd4c42c66ab818142240348173a669d1d2537fe patch