CVE-2025-9728 - CVE House
Back to Database
Status published Medium CVE-2025-9728

givanz Vvveb login.tpl cross site scripting

Vulnerability Description

A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of the argument Email/Password leads to cross site scripting. The attack can be executed remotely. The name of the patch is bbd4c42c66ab818142240348173a669d1d2537fe. Applying a patch is advised to resolve this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-9728

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • andyp138 (VulDB User)

References

More from givanz

View All →
CVE-2025-9397
givanz Vvveb media.php unrestricted upload
Medium 5.3
CVE-2025-8976
givanz Vvveb Endpoint post cross site scripting
Medium 5.1
CVE-2025-8975
givanz Vvveb edit.tpl cross site scripting
Medium 5.1
CVE-2025-8522
givanz Vvvebjs node.js save.php path traversal
Low 2.3
CVE-2025-8521
givanz Vvveb Add Type post-types cross site scripting
Medium 4.8

Affected Vendor

Affected Software

Vvveb
Vulnerable Versions:
1.0.7.2

Timeline

Official Publish: August 31st, 2025
Last Modified: September 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

Weaknesses (CWE)

CWE-79 CWE-94

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1565.002 Stored Data Manipulation
Impact