CVE-2026-41932

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41932

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41932.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41932

Published

2026-05-14T14:19:34.658Z

Modified

2026-07-08T08:13:13.188569794Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Vvveb < 1.0.8.3 Stored XSS via Signup Controller

Details

Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the displayname field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the displayname column, allowing stored XSS execution when display_name is rendered without encoding in vulnerable views.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41932.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type

GIT

Repo

https://github.com/givanz/vvveb

Events

Introduced

Fixed

301e9b66a3b3a1cb42cb05ad1ff3cd428ed30b26

Fixed

fefac290a8c85d3c87fe80ffed68b6c5bc50e93c

Database specific

{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.8.3"
        }
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.7.1

1.0.7.2

1.0.7.3

1.0.8

1.0.8.1

1.0.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41932.json"