LowPublic exploit

Code Injection in givanz Vvveb 1.0.5 Code Editor Save Function

IdentifiersCVE-2025-8518CWE-94· Improper Control of Generation of…

CVE-2025-8518 is a critical remote code injection vulnerability in givanz Vvveb version 1.0.5. The issue affects the Save function in admin/controller/editor/code.php within the Code Editor component. According to the provided information, attacker-controlled input can be manipulated during the save operation, resulting in code injection. The vulnerability is remotely exploitable, and a public exploit has been disclosed. The issue is fixed in version 1.0.6 via patch commit f684f3e374d04db715730fc4796e102f5ebcacb2.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to inject code through the vulnerable Code Editor save functionality. Depending on how the injected code is processed by the application and server environment, this can lead to unauthorized modification of application code or content and may result in arbitrary code execution in the context of the affected application. Because the attack can be launched remotely and public exploit information exists, the risk of compromise is elevated.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrading is not possible, restrict or disable access to the Code Editor component, especially the vulnerable Save functionality in admin/controller/editor/code.php. Limit remote access to trusted administrative networks only, enforce strong authentication and authorization around editor features, and monitor for suspicious save operations or unexpected file/content changes. As a temporary measure, remove or firewall access to the affected administrative interface until the fixed version can be deployed.

Remediation

Patch, then assume compromise.

Upgrade givanz Vvveb from version 1.0.5 to version 1.0.6 or later. The vendor-referenced fix is patch commit f684f3e374d04db715730fc4796e102f5ebcacb2. Apply the patched release to all affected deployments and verify that the vulnerable Code Editor component and its Save functionality are no longer exposed in the vulnerable form.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).

VALID 1 / 3 TOTALView more in app

vvveb_auth_rce_cve_2025_8518.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit module targeting a remote code execution vulnerability (CVE-2025-8518) in Vvveb CMS versions up to and including 1.0.5. The exploit leverages the Code Editor functionality in the admin interface, which fails to properly sanitize file edits, allowing an authenticated attacker to inject arbitrary PHP code into theme files. The module authenticates using provided credentials, locates the active theme, reads and stores the original theme file, overwrites it with a Metasploit payload, and then triggers the payload by accessing the theme. The exploit is weaponized, supporting customizable Metasploit payloads (e.g., reverse shell), and is suitable for post-authentication attacks. The code interacts with several HTTP endpoints in the Vvveb CMS admin interface to perform authentication, file manipulation, and payload execution. The repository is structured as a single Ruby file compatible with the Metasploit framework.

Disclosed Jan 10, 2025rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

VvvebVvvebapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

8 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

8 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity8