Josangeorge

**Name of the Vulnerable Software and Affected Versions** Vvveb versions prior to 1.0.8.5 **Description** A flaw exists in the way user profile bios are processed. The file 'app/controller/user/profile.php' accepts the `user[bio]` field and processes it using the `sanitizeHTML()` function in 'system/functions.php'. Due to a regular expression error regarding the forward-slash delimiter and a faulty do-while condition, forbidden nested tags are only removed once. This allows users with an Author role or higher to bypass sanitization by submitting nested forbidden tags or solidus-prefixed event-handler markup. The unsanitized content is rendered without sufficient output encoding on the '/author/{username}' endpoint, in the admin user-management view, and potentially in comment displays. This can lead to the execution of attacker-controlled JavaScript, potentially exposing browser-session data, enabling account actions in the victim's context, defacement, or phishing. **Recommendations** Update to version 1.0.8.5.