CVE-2026-126323
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status.