CVE-2025-8521 MEDIUM

CVE-2025-8521: givanz Vvveb Add Type post-types cross site scripting

Vendor Givanz
Product Vvveb
Weakness CWE-79 · XSS
Published August 4, 2025
Last update August 5, 2025
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named b53c7161da606f512b7efcb392d6ffc708688d49/605a70f8729e4d44ebe272671cb1e43e3d6ae014. It is recommended to upgrade the affected component.

Key dates

02Disclosure timeline

August 4, 2025 CVE published
August 5, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-22548 WordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerability CVE-2023-39511 Stored Cross-Site-Scripting on reports_admin.php device name in Cacti CVE-2025-9131 Ogulo – 360° Tour <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter CVE-2024-49505 XSS vulnerability found in OpenSuse MirrorCache CVE-2023-49157 WordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)