Description
A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.
Published: 2026-09-13
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

A client‑side cross‑site scripting flaw exists in the utils.toToc function of ArticleController.java in maliangnansheng bbs‑springboot. Input is not properly encoded, allowing an attacker to inject scripts that execute in users’ browsers when the page is rendered. This enables arbitrary client‑side code execution. The assessment is based solely on the provided description; no additional exploitation consequences are specified.

Affected Systems

The flaw exists in maliangnansheng bbs‑springboot version 3.0.0. No other vendor or product variants or version ranges are indicated in the available data.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate risk level. The EPSS score of < 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by supplying crafted input to the utils.toToc endpoint; no special privileges or local access are required.

Generated by OpenCVE AI on September 15, 2026 at 16:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest version of maliangnansheng bbs‑springboot that contains the XSS fix
  • Configure a Content‑Security‑Policy header to restrict inline script execution
  • Add server‑side input validation and output encoding for parameters handled by utils.toToc

Generated by OpenCVE AI on September 15, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 13 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.
Title maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting
First Time appeared Maliangnansheng
Maliangnansheng bbs-springboot
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:maliangnansheng:bbs-springboot:*:*:*:*:*:*:*:*
Vendors & Products Maliangnansheng
Maliangnansheng bbs-springboot
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 3.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 3.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Maliangnansheng Bbs-springboot
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-16T19:36:23.886Z

Reserved: 2026-09-12T15:45:16.238Z

Link: CVE-2026-90563

cve-icon Vulnrichment

Updated: 2026-09-16T19:36:20.947Z

cve-icon NVD

Status : Deferred

Published: 2026-09-13T15:16:28.990

Modified: 2026-09-16T20:17:38.957

Link: CVE-2026-90563

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T16:45:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')