Read the docs
TI-2026-32709 Aliases CVE-2026-44826

Vvveb: Vvveb CMS — Negative-quantity cart manipulation allows creation of orders with negative grand totals

Priority HIGH 72CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00256 17th percentileScored 2026-11-07
Fix Fixed Vvveb (givanz): 1.0.8.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
givanzVvvebbefore 1.0.8.21.0.8.2Patch availableCNA
  • Vvveb Vendorgivanz Affected before 1.0.8.2 Fixed in 1.0.8.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:*——givanz
  • cpe:2.3:a:vvveb:vvveb:*:*:*:*:*:*:*:* Versions — — ·givanz

Remediation

  • Fix · CNA Vvveb (givanz) Fixed in 1.0.8.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44826

References

Other 1

  • TI-2026-83112 Authentication bypass in Vvveb password reset enables account takeover CVSS 3.1CRITICAL 9.8
  • TI-2025-28570 An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. CVSS 3.1CRITICAL 9.8
  • TI-2024-18282 givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. CVSS 3.1CRITICAL 9.8
  • TI-2024-16622 givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. CVSS 3.1CRITICAL 9.8
  • TI-2024-16621 A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both… CVSS 3.1CRITICAL 9.1
  • TI-2026-83115 Authenticated IDOR in Vvveb lets admins steal other admins' API tokens CVSS 3.1CRITICAL 9.0
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences