CVE-2025-11029: vvveb CSRF — Exploit

Description

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."

Is your site exposed to CVE-2025-11029?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness Type (CWE)

CWE-352 Cross-Site Request Forgery

CWE-862 Missing Authorization

Affected Products

Vendor	Product	Versions
vvveb	vvveb	< 1.0.7.2

References

Exploits

https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fce https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423 https://gist.github.com/KhanMarshaI/165ae8f63ec6b5fdf1f4123252499fce https://gist.github.com/KhanMarshaI/db888b65cfd75bead2035348babfb423

Other References

https://vuldb.com/?ctiid.325967 https://vuldb.com/?id.325967 https://vuldb.com/?submit.657188 https://vuldb.com/?submit.657190 https://vuldb.com/?submit.657191 https://vuldb.com/?submit.657192

Frequently Asked Questions

What is CVE-2025-11029? +

A weakness has been identified in givanz Vvveb up to 1.0.7.2. This vulnerability affects unknown code. Executing manipulation can lead to cross-site request forgery. The attack can be executed remotely. The exploit has been made available to the public and could be exploited. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release." It has a CVSS v3.1 base score of 4.3 (MEDIUM).

How severe is CVE-2025-11029? +

CVE-2025-11029 has a CVSS v3.1 score of 4.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-11029? +

CVE-2025-11029 affects products from vvveb, specifically: vvveb. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-11029? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40325

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the `cTrash.restore` function does …

CVE-2026-40174

Masa CMS is a content management system forked from Mura CMS. In versions 7.5.2 and earlier, the cUsers.updateAddress function does …

CVE-2024-6662

Websites managed by MegaBIP in versions below 5.15 are vulnerable to Cross-Site Request Forgery (CSRF) as the form available under …

CVE-2026-42286

Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows …

CVE-2026-9591

Cross-site request forgery (CSRF) in NewsItemApiController in SimplCommerce prior to commit 6233d73e allows an unauthenticated remote attacker to create or …

CVE-2024-7141

Versions of Gliffy Online prior to versions 4.14.0-7 contains a Cross Site Request Forgery (CSRF) flaw.

CVE-2025-11029