What’s Vulnerable › Vulnerabilities

CVE-2024-25181

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-29 · updated 2026-10-27
• Weakness: CWE-918

Description

A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary file reading. The vulnerability stems from improper handling of user-supplied URLs in the "file_get_contents" function within the "save.php" file.

Affected products

• givanz Vvvebjs: through 1.7.4

References

• https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de
• https://gist.github.com/joaoviictorti/69cbae23d98fb9a1a4b3eee0c305c7de

Get alerted when CVE-2024-25181 or the next vulnerability affects your stack