CVE-2026-90563

maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.

Analysis

AI-generated

Technical impact

A client‑side cross‑site scripting flaw exists in the utils.toToc function of ArticleController.java in maliangnansheng bbs‑springboot. Input is not properly encoded, allowing an attacker to inject scripts that execute in users’ browsers when the page is rendered. This enables arbitrary client‑side code execution. The assessment is based solely on the provided description; no additional exploitation consequences are specified.

Affected Systems

The flaw exists in maliangnansheng bbs‑springboot version 3.0.0. No other vendor or product variants or version ranges are indicated in the available data.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk level. The EPSS score of < 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying crafted input to the utils.toToc endpoint; no special privileges or local access are required.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest version of maliangnansheng bbs‑springboot that contains the XSS fix
  • Configure a Content‑Security‑Policy header to restrict inline script execution
  • Add server‑side input validation and output encoding for parameters handled by utils.toToc

Generated by OpenCVE AI on September 15, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.
Title maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
First Time appeared Maliangnansheng
Maliangnansheng bbs-springboot
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:maliangnansheng:bbs-springboot:*:*:*:*:*:*:*:*
Vendors & Products Maliangnansheng
Maliangnansheng bbs-springboot
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 16, 2026, 7:36 PM
Reserved
Sep 12, 2026, 3:45 PM

View source JSON

Updated
Sep 16, 2026, 7:36 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 3:16 PM
Modified
Sep 16, 2026, 8:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:45 PM

JSON