CVE-2025-44022 Code injection in n/a
Remote attackers can execute arbitrary code in vvveb CMS via the Plugin mechanism, posing a critical risk to site integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-44022?
CVE-2025-44022 is a critical code injection vulnerability in n/a, published on 12 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism.
Weakness: CWE-94
Which versions are affected by CVE-2025-44022?
It affects 1 product.
Products include Vvveb Vvveb.
How do I fix CVE-2025-44022?
No fix has been published for CVE-2025-44022 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-44022 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-44022 exists.
Other vulnerabilities in n/a
- CVE-2025-11028 givanz Vvveb Image information disclosure
- CVE-2025-12203 givanz Vvveb Code Editor functions.php sanitizeFileName path traversal
- CVE-2025-11029 givanz Vvveb cross-site request forgery
- CVE-2025-9728 givanz Vvveb login.tpl cross site scripting
- CVE-2025-9397 givanz Vvveb media.php unrestricted upload
Sources
Also known as GHSA-5cxg-299x-c7pc.