The vulnerability allows an attacker to embed arbitrary HTML and JavaScript in the username field when creating a new user account. The system copies the raw input into the display_name field before any sanitization, storing the malicious payload verbatim. When a view renders that display_name without encoding, the script runs in the victim’s browser, allowing execution of arbitrary client‑side code. The CVSS score of 5.3 indicates a medium severity risk to confidentiality and integrity for any user who views the affected page.

The affected product is Vvveb, a content management system by givanz. Any installation running a version earlier than 1.0.8.3 is vulnerable. The vulnerability is present in the signup flow of all pre‑1.0.8.3 releases.

Because the flaw is in the public signup route, an attacker can trigger it simply by creating an account with a crafted username; no prior authentication is required. The stored payload then persists until the display_name is rendered, making exploitation straightforward if a user views the profile or any page that displays that field. The EPSS score is not available, and the issue is not listed in CISA KEV, but the medium CVSS score and the ease of exploitation suggest that it should be treated with a high level of caution.