The vulnerability in Vvveb CMS (before version 1.0.8.2) stems from improper validation of the quantity parameter on the cart-add endpoint. Negative integers submitted as quantity are accepted and treated as negative values in all subsequent calculations including line total, subtotal, taxes, and grand total. This leads to negative order totals being displayed to customers and accepted by the checkout process. The resulting orders with negative totals are persisted in the merchant's order database, creating inconsistent and potentially exploitable financial records. The vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input) and has a CVSS 3.1 score of 7.5 (high severity).

The impact is primarily on the integrity of order data and financial records within the affected Vvveb CMS installations. Merchants may see orders with negative totals, which can disrupt accounting and order management processes. Although no direct confidentiality or availability impact is indicated, the integrity impact is high due to the potential for financial discrepancies. There is no evidence of known exploits in the wild at this time.

This vulnerability is fixed in Vvveb CMS version 1.0.8.2. Users should upgrade to version 1.0.8.2 or later to remediate this issue. No official patch link is provided in the data, but upgrading to the fixed version is the recommended action. Since this is not a cloud service, remediation depends on the user applying the update. Patch status is not explicitly confirmed beyond the version fix note; users should verify with the vendor for the latest advisory and update instructions.