CVE-2025-8518
MEDIUMVvveb 1.0.5 - Remote Code Execution in Code Editor Save Function
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-8518.
PoCs published by maestro-ant, Maksim Rogov, Hamed Kohi, including Metasploit module exploits/multi/http/vvveb_auth_rce_cve_2025_8518.
AI-analyzed exploit summary This repository provides detailed deployment instructions for setting up a vulnerable environment of Vvveb CMS 1.0.5 to demonstrate CVE-2025-8518, an authenticated RCE vulnerability. It includes steps for Docker setup, configuration modifications, and launching the application but lacks actual exploit code.
Description
A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor/code.php of the component Code Editor. The manipulation leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The name of the patch is f684f3e374d04db715730fc4796e102f5ebcacb2. It is recommended to upgrade the affected component.
Exploits (2)
This repository provides detailed deployment instructions for setting up a vulnerable environment of Vvveb CMS 1.0.5 to demonstrate CVE-2025-8518, an authenticated RCE vulnerability. It includes steps for Docker setup, configuration modifications, and launching the application but lacks actual exploit code.
This Metasploit module exploits an authenticated remote code execution vulnerability in Vvveb CMS (CVE-2025-8518) by injecting malicious PHP code into theme files via the Code Editor functionality. The exploit authenticates, identifies the active theme, modifies the theme file with a PHP payload, and triggers execution.
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L