Vvveb CMS
Productivity & WikisA powerful, easy‑to‑use CMS with a drag‑and‑drop page builder for websites, blogs, and ecommerce stores.
Features
- Drag‑and‑drop page builder
- Multi‑site support with localization and multi‑language capabilities
- Comprehensive ecommerce features (one‑page checkout, subscriptions, digital assets, vouchers, product variants, etc.)
Recent releases
View all 7 releases →
1.0.8.2
Breaking risk
Security fixes
- GHSA-xgvg-r47g-786r – Pre‑authentication PHP stack‑trace & source‑code disclosure via DEBUG=true
- GHSA-vfjj-gcvv-w248 – Authenticated Remote Code Execution (RCE) via editor/code/save, restricted to admins only
- GHSA-qpcx-gx2x-r8v2 – Unauthenticated RCE from PHP file uploads disguised as images, masked extensions added to deny list
Notable features
- Enable categories and tags for pages (post type)
- Limit title and meta description length per SEO recommendations
- Duplicate functionality for product options
Full changelog
- Enable categories and tags for pages (page post type) https://github.com/givanz/Vvveb/commit/8b9db6a408ba35d8ac1dd078823c73f76584d78f
- Limit title and meta description length based on SEO recommendations https://github.com/givanz/Vvveb/commit/520d4f96511537c60e3de2ebab7aa8027d227024
- Duplicate for product options https://github.com/givanz/Vvveb/commit/5559555503f6bf5dbe40a6d5478bd8339746455a
- Theme install log display fix https://github.com/givanz/Vvveb/commit/7edc49400cd5b549d77a84abe6448df8e9a85442
- User template fix https://github.com/givanz/Vvveb/commit/7be3b3bf146a3aaf1da90927e6462f791175c8b8
- Removed test code that displays cron url https://github.com/givanz/Vvveb/commit/517bc09faf44136e72de391aacc8b90a706f7ae7
- Set sitemap paths to match website path https://github.com/givanz/Vvveb/commit/00443692939ebbb8a4710ab7747b215e18ec9e37
- Fixed pagination wrong url for first page https://github.com/givanz/Vvveb/commit/de1206ff243607733388d89aa8aa07d9da9350f6
- Clear frontend cache on clear all cache https://github.com/givanz/Vvveb/commit/7665586f29e9e9181d05ca72860571872f074608
- Removed LIBXML_NOENT https://github.com/givanz/Vvveb/commit/098fc428586f20ee02981af976512fb62bc25b8a
- Don't include code on exceptions when code is running in cli https://github.com/givanz/Vvveb/commit/0a782c2ac1d0c4376ee4d61ba391c83a150976be
- Match cache file without glob https://github.com/givanz/Vvveb/commit/463ab364450e962cb399f7c7bf8f8fcec0284302
- Include credentials for component render requests https://github.com/givanz/Vvveb/commit/575ff4d14b6cbabfb307b3e696dc322000e7d94b
- Themes update https://github.com/givanz/Vvveb/commit/bf9ebca62f4d84a2dfeb601a289fe4c0bf9f50f4
- Pgsql fixes https://github.com/givanz/Vvveb/commit/3586df5cc0d49c0ef208f9834647948b8efc7e2c https://github.com/givanz/Vvveb/issues/425 https://github.com/givanz/Vvveb/issues/427
- Set debug to false by default to hide trace info that exposes php files path, Pre-authentication PHP Stack-Trace and Source-Code Disclosure via DEBUG=true GHSA-xgvg-r47g-786r reported by @CyberWarrior9
- Restrict php file save, removed editor permission for author and contributor roles, fix for Authenticated RCE via editor/code/save GHSA-vfjj-gcvv-w248 reported by https://github.com/givanz/Vvveb/commit/1196561276a3f49da5a714fef89ac9a6c6f9e33b @CyberWarrior9
- Restrict php file uploads masked as images, fix for Unauthenticated Remote Code Execution GHSA-qpcx-gx2x-r8v2 reported by https://github.com/givanz/Vvveb/commit/9a11fa692061c8e934144b489ed95c55e08822e6 @CyberWarrior9
- User key check for editor component rendering https://github.com/givanz/Vvveb/commit/fd8e53f48d62819d23903d5ea36d121b1e61c4ee
- Added admin and user key check for editor component rendering to fix Unauthenticated Reflected Cross-Site Scripting via Editor Preview Bypass GHSA-wwmv-4g9g-p48g reported by https://github.com/givanz/Vvveb/commit/54a9e846fb94192f1b31ae81d81d25c874662e6a @CyberWarrior9
- Commented phpmyadmin to avoid security vulnerabilities fix for GHSA-g38h-mr9p-fjmf reported by https://github.com/givanz/Vvveb/commit/729fd1b8601c7e116ecd52536b045a31ee58f85d @CyberWarrior9
- Removed LIBXML_NOENT and and LIBXML_NONET from loadXML options, fix for https://github.com/givanz/Vvveb/commit/86f7128a18edebe0ff47e3855558467eb0ef9106 GHSA-rfxr-4xpm-wrp7 reported by @CyberWarrior9
- Added .phtml and .htaccess extensions to media upload deny list https://github.com/givanz/Vvveb/commit/917c7347431fa571df5cf33f850834dacc78a6fb GHSA-qpcx-gx2x-r8v2 reported by @CyberWarrior9
- Fix for:Negative-quantity cart manipulation allows creation of orders with negative grand totals https://github.com/givanz/Vvveb/commit/e7f2843618f6e58867bd158dc5620cf61d212f51 GHSA-75x2-j47j-mg8j reported by @CyberWarrior9
- Fixed PHP Deprecated: exit(: Passing null https://github.com/givanz/Vvveb/commit/1e4d9b8469cd70ea6ce9b5272ba59180da593609 https://github.com/givanz/Vvveb/issues/217
- Fix for Stored XSS via Comment Author Field GHSA-gpmg-pcxr-9wvf reported https://github.com/givanz/vvveb-admin-template/commit/70377c5fb3a7ae3acbe6764d7ab3fcdd8b2eb805 https://github.com/givanz/Vvveb/commit/4cd2962fa0a4bad144f305920d5ba09619b1d79f by @nchloride
- Fix for 'DOM-based cross-site scripting (XSS) vulnerability on order edit page through checkout page inputs' https://github.com/givanz/vvveb-admin-template/commit/d3e97d544c9c6c46700ddd55da7025f01e19c55e reported by Noel Carlo Lopez @nchloride
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
About
Stars
1,092
Forks
199
Languages
HTML
PHP
JavaScript
Install & Platforms
Install via
shell-script
