Vvveb CMS fails to validate the sign of the quantity parameter submitted to its cart-add endpoint. A negative integer is interpreted as a normal line item yet the sign propagates into all subsequent calculations. The line total, sub‑total, taxes and grand total become negative, causing the customer‑facing UI to display a negative grand total and allowing the checkout flow to accept the cart. As a result, an order is persisted in the merchant's database with a negative total, producing a record that indicates the merchant owes money to the customer—a condition that cannot arise through any legitimate workflow.

Vvveb CMS, developed by givanz, is affected in all releases before version 1.0.8.2. The issue is present in any instance of the cart‑add endpoint that accepts the quantity parameter without sign validation.

The CVSS score of 7.5 reflects a high impact level, though no EPSS score is available and the vulnerability is not listed in CISA KEV. Attackers can exploit this flaw simply by crafting a malicious HTTP request with a negative quantity to the cart‑add endpoint, a capability available to anyone who can reach the target website. Successful exploitation leads to a financial loss for the merchant and potential confusion or fraud.