CVE-2026-41932 is a stored cross-site scripting vulnerability in the givanz Vvveb product affecting versions prior to 1.0.8.3. The issue occurs in the Signup::addUser() controller where the username POST parameter is copied verbatim into the display_name field before any sanitization. Although the username column is sanitized, the display_name field retains the malicious input, which is then rendered without encoding in certain views, allowing an attacker to execute arbitrary scripts in the context of the affected application.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of users viewing the affected display_name field. This can lead to session hijacking, defacement, or other client-side attacks. The vulnerability is rated medium severity with a CVSS 4.0 base score of 5.3, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid rendering the display_name field without proper encoding or sanitization. Implement input validation and output encoding on the display_name field to prevent script execution.