CVE-2026-41929

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41929

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41929.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41929

Aliases

CVE-2026-41938
GHSA-wwmv-4g9g-p48g

Published

2026-05-07T21:08:50.762Z

Modified

2026-07-16T03:31:14.386816042Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor

Details

Vvveb before 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer that allows attackers to execute arbitrary JavaScript by manipulating the r query parameter and componentajax POST parameter. Attackers can craft a malicious link or auto-submitted form that causes victims to execute attacker-controlled JavaScript in the context of the Vvveb origin, as the gating function isEditor() performs no session, role, or token verification and the view handler injects raw HTML POST body content without sanitization.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41929.json"
}

References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type

GIT

Repo

https://github.com/givanz/vvveb

Events

Introduced

Fixed

8b9db6a408ba35d8ac1dd078823c73f76584d78f

Fixed

54a9e846fb94192f1b31ae81d81d25c874662e6a

Database specific

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.8.2"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.7.1

1.0.7.2

1.0.7.3

1.0.8

1.0.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41929.json"