Stored Cross-Site Scripting in Vvveb by Givanz

CVE-2026-41932

What is CVE-2026-41932?

Vvveb versions before 1.0.8.3 are susceptible to a stored cross-site scripting vulnerability during user signup. The vulnerability arises when the Signup::addUser() controller handles raw POST username values improperly, copying them into the display_name field without adequate sanitization. Although the username is stripped from the database, the unfiltered display_name retains the raw HTML and script content. This flaw can lead to the execution of malicious scripts when the display_name is rendered in certain views that do not apply necessary encoding.

References