CVE-2026-41932

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description A stored cross-site scripting issue exists in the customer signup flow. The Signup::addUser() controller copies raw POST username values into the display name field before sanitization. This allows attackers to submit HTML and script markup in the username field during signup; while the markup is stripped from the username column, it is persisted in the display name column. The script executes when the display name is rendered without encoding in vulnerable views.

Recommendations Update Vvveb to version 1.0.8.3 or later.