CVE-2026-41932: Vvveb < 1.0.8.3 Stored XSS via Signup Controller
Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the displayname field before sanitization occurs. Attackers can submit HTML and script markup in the username field during signup, which gets stripped from the username column but persisted verbatim in the displayname column, allowing stored XSS execution when displayname is rendered without encoding in vulnerable views.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41932?
CVE-2026-41932 has been classified with a high severity due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2026-41932?
To fix CVE-2026-41932, upgrade to Vvveb version 1.0.8.3 or later where the vulnerability is patched.
What vulnerability does CVE-2026-41932 describe?
CVE-2026-41932 describes a stored cross-site scripting vulnerability in the customer signup flow of Vvveb before version 1.0.8.3.
Who is affected by CVE-2026-41932?
Users and administrators of Vvveb versions earlier than 1.0.8.3 are affected by CVE-2026-41932.
How can attackers exploit CVE-2026-41932?
Attackers can exploit CVE-2026-41932 by submitting crafted input during the signup process, resulting in stored scripts that execute on other users' browsers.