CVE-2026-49225

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.4

Description Backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The endpoint 'admin/controller/product/revisions.php' reuses 'admin/controller/content/revisions.php', while the file 'admin/sql/sqlite/product content revision.sql' trusts caller-controlled product id, language id, and created at values without applying the current admin id to revision reads, restores, and deletes. This allows an attacker to read historic product content, restore a revision over another Vendor's live product content, or delete revision records, which can expose private copies, corrupt product pages, and remove audit history.

Recommendations Update to version 1.0.8.4.