CVE-2026-126374

CVSS 5.3 (medium) · published 2026-11-13

Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.

Weakness: CWE-89

Source: NVD CVE-2026-126374

References

• https://github.com/givanz/Vvveb/security/advisories/GHSA-fwp9-mpg4-hh5w
• https://www.vulncheck.com/advisories/vvveb-through-1.0.8.6-sql-injection-via-keys-each-array-keys

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.