CVE-2026-44826

The record

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2.

Affected packages

Related vulnerabilities

• CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-1284
• CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write data… CWE-1284
• CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite can be… CWE-1284
• CVE-2026-93749 source-map-js through 1.2.1 fails to validate the per-section offset line value in… CWE-1284
• CVE-2026-87962 t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in… CWE-1284
• CVE-2026-87735 An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. CWE-1284
• CVE-2026-87470 Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36… CWE-1284
• CVE-2026-79376 An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth… CWE-1284