CVE-2026-126370

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.7

Description A remote code execution issue allows users with restricted site admin roles to inject PHP code by saving .sql files via the admin code editor. This is achieved by using an @IF macro payload to bypass extension and content deny-lists. When the model loads, the payload compiles into executable PHP, enabling the execution of operating system commands with the privileges of the web user.

Recommendations Update Vvveb to version 1.0.8.7 or later.