The flaw allows a logged‑in user to inject arbitrary SQL into the ORDER BY clause of the user order history page. Because the order_by and direction parameters are concatenated directly into the query without validation, an attacker can read or manipulate database contents, leading to data exposure or integrity issues. The vulnerability is only exploitable by authenticated users, but once authenticated, any user of the site can trigger the injection.

The issue exists in the Vvveb CMS delivered by givanz, affecting all installations running a version older than 1.0.8.3. No other product variants or vendor versions were identified.

With a CVSS score of 8.7, the vulnerability is considered high severity. The exploit requires web access and an authenticated session, so it is not trivial for an external attacker but could be leveraged by any user with login credentials. EPSS data is not available, and the flaw is not yet listed in the CISA KEV catalogue, but the confirmed attack path indicates a direct injection risk. Systems should patch promptly.