A flaw was discovered in atjiu pybbs 6.0.0 that affects the create method of the CommentApiController. The API allows a malicious user to supply script code that is stored and then returned in the rendered page. The stored payload can be executed in the browsers of visitors, enabling the attacker to run arbitrary JavaScript in the victim’s context. The weakness aligns with CWE‑79 and may also involve code injection concerns expressed through CWE‑94.

The affected product is atjiu pybbs version 6.0.0. No other versions are explicitly mentioned, and no vendor statement indicates that it is fixed in later releases. The system is a Java‑based web forum application that exposes a REST endpoint for comment creation.

The CVSS assessment gives the vulnerability a score of 5.1, placing it in the medium severity range. The EPSS probability is less than 1 %, indicating a low exploitation likelihood at present. The issue has been publicly disclosed and an exploit is available, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector involves a remote user submitting a crafted comment through the exposed API endpoint, which bypasses input sanitization and injects script code into the page.