PT-2026-27777 · Unknown · Support Board

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-4816

Positive Technologies · (AI Summary)

CVSS v4.0

4.8

Medium

AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Support Board version 3.7.7

Description A Reflected Cross Site Scripting (XSS) issue exists in Support Board. This allows an attacker to execute JavaScript code in a user's browser. The attack vector involves sending a malicious URL to a victim, utilizing the search parameter within the '/supportboard/include/articles.php' endpoint. Successful exploitation could lead to the theft of sensitive user data, such as session cookies, or the execution of unauthorized actions on behalf of the user.

Recommendations Update Support Board to a version that addresses this issue. As a temporary workaround, sanitize all user inputs to the search parameter in the '/supportboard/include/articles.php' endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4816

Affected Products

Support Board

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-4816 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-support-board-schiocco · Patch
• https://twitter.com/cyberbivash/status/2036854261233877265 · Twitter Post