The vulnerability in givanz Vvveb before version 1.0.8.3 is a stored cross-site scripting issue in the customer signup process. Specifically, the Signup::addUser() controller fails to sanitize the display_name field after copying raw POST username input. Attackers can inject HTML or script code into the username field during signup, which is stripped from the username column but stored without encoding in display_name. When display_name is later rendered in vulnerable views without proper encoding, this leads to stored XSS execution. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity, with some scope and availability impact. No patch or official fix has been published yet.

Successful exploitation allows an attacker to execute stored cross-site scripting attacks via the display_name field in the signup flow. This can lead to execution of arbitrary scripts in the context of affected users viewing the vulnerable views. The impact is rated medium severity with limited confidentiality and integrity impact but some availability and scope impact as per CVSS 4.0 scoring. There are no known active exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input sanitization or output encoding on the display_name field in their deployment to prevent script execution. Avoid rendering display_name without proper encoding in web views. Monitor vendor channels for updates regarding an official patch or mitigation.