Threats affecting pkg:github/givanz/VvvebJs

A cross-site scripting (XSS) vulnerability exists in givanz Vvvebjs versions up to 2.0.5. The issue arises from improper handling of the uploadAllowExtensions argument in the file upload.php component, allowing remote attackers to execute script code. A patch has been released by the vendor to address this vulnerability. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php.

Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obtain sensitive information via the action parameter in save.php.