CVE-2026-126374: Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and adminauthtoken.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated back-office access and the ability to save products. The affected input is supplied through product_<feature> POST array keys.
What must an attacker provide to trigger the SQL injection?
The attacker can submit product_<feature> array keys containing backticks. Those keys are emitted as backtick-quoted INSERT column names without escaping, allowing bound values to be redirected into otherwise unexposed columns or causing SQL statements to break.
Which code paths are identified as lacking the relevant input protection?
Several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. The issue is associated with the @KEYS(:each) macro's handling of PHP array keys.