CVE-2025-11944 MEDIUM

CVE-2025-11944: givanz Vvveb Raw SQL import.php import sql injection

Vendor Givanz
Product Vvveb
Weakness CWE-89 · SQLi
Published October 19, 2025
Last update February 24, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was determined in givanz Vvveb up to 1.0.7.3. This affects the function Import of the file admin/controller/tools/import.php of the component Raw SQL Handler. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 52204b4a106b2fb02d16eee06a88a1f2697f9b35. It is recommended to apply a patch to fix this issue.

Key dates

02Disclosure timeline

October 19, 2025 CVE published
February 24, 2026 Record updated