Stored Cross-Site Scripting Vulnerability in Vvveb by Givanz
CVE-2026-34429

5.1MEDIUM

Key Information:

Vendor

Givanz

Status
Vvveb
Vendor
CVE Published:
20 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-34429?

The Vvveb product prior to version 1.0.8.1 contains a stored cross-site scripting vulnerability. This issue allows authenticated users with media upload and rename permissions to exploit the application by executing arbitrary JavaScript. The vulnerability arises from the ability to bypass MIME type validation through renaming uploaded files to executable extensions. Attackers can prepend a GIF89a header to HTML/JavaScript payloads, rename the file to an .html extension, and execute malicious scripts within an administrator's browser session. This can lead to the creation of backdoor accounts and the uploading of malicious plugins for remote code execution.

Affected Version(s)

Vvveb 0 < 1.0.8.1

Vvveb cc997d3359ea5e49a45c132f5dee3bc80fb441d7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-34429 - Proof of Concept

References

https://delta.cyberm.ca/bugbin/ur66bvB7BYTC9y0eCIk3uzhZQg...
technical-descriptionexploit
https://github.com/givanz/Vvveb/releases/tag/1.0.8.1
release-notes
https://github.com/givanz/Vvveb/commit/cc997d3359ea5e49a4...
patch

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hamed Kohi
VulnCheck
.