CVE-2026-45800: Vvveb: Authenticated SQL injection in /user/orders via order_by and direction
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an authenticated SQL injection issue in the frontend user order history page in Vvveb CMS. A normal frontend user can log in and access /user/orders. The orderby and direction request parameters are accepted from the URL, propagated through the Orders component, and directly concatenated into the SQL ORDER BY clause in OrderSQL::getAll(). Because of this, attacker-controlled input reaches SQL structure without a whitelist or safe query construction step. This vulnerability is fixed in 1.0.8.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45800?
CVE-2026-45800 is considered a critical vulnerability due to its potential for authenticated SQL injection.
How do I fix CVE-2026-45800?
To fix CVE-2026-45800, upgrade Vvveb CMS to version 1.0.8.3 or later.
Who is affected by CVE-2026-45800?
CVE-2026-45800 affects users of Vvveb CMS versions prior to 1.0.8.3.
What kind of vulnerability is CVE-2026-45800?
CVE-2026-45800 is an authenticated SQL injection vulnerability found in the user order history feature.
What can attackers do with CVE-2026-45800?
Attackers can exploit CVE-2026-45800 to manipulate SQL queries, leading to unauthorized data access and potential data breaches.