The reported vulnerability resides in the create method of TopicApiController.java in atjiu pybbs 6.0.0. The attacker can manipulate request data to inject arbitrary JavaScript, causing a cross‑site scripting flaw. The advisory states the attack can be initiated remotely and an exploit is publicly available. Based on the description, it is inferred that the injected script will execute in a victim’s browser context, potentially enabling actions such as cookie theft or session hijacking.

Affected product: atjiu pybbs, version 6.0.0. No other vendors or products are listed. The vulnerability is confined to the TopicApiController.create endpoint of that version.

The CVSS score of 5.1 places this flaw in the medium‑severity range. No EPSS score is reported, and the vulnerability is not listed in the KEV catalog. Nonetheless, the advisory notes that the exploit is publicly available and can be invoked remotely, indicating a realistic risk for publicly reachable instances. The overall threat can increase with the volume of traffic or the sensitivity of information handled by the application.