PT-2026-26653 · Atjiu · Pybbs

Xcxr · Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-4494

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions atjiu pybbs version 6.0.0

Description A flaw in the create() function within the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java allows for remote cross-site scripting, a technique where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-4494

Affected Products

Pybbs

References · 5

• 🔥 https://fx4tqqfvdw4.feishu.cn/docx/EKVgdqWIzo70C0xB5jxcb4IZnre?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-4494 · Security Note
• https://vuldb.com/?submit.773779 · Note
• https://vuldb.com/?id.352020 · Note
• https://vuldb.com/?ctiid.352020 · Note