PT-2026-36484 · V2Board · V2Board

Sginnora · Published 2026-05-01 · Updated 2026-05-11 · CVE-2026-37503

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AC:L/AV:N/A:N/C:H/I:L/PR:H/S:C/UI:R

Name of the Vulnerable Software and Affected Versions V2Board versions prior to 1.7.5

Description Cross-Site Scripting (XSS) occurs when the custom html field in the theme configuration is rendered using unescaped Blade output in the 'public/theme/v2board/dashboard.blade.php' file. An administrator can inject arbitrary JavaScript through the 'saveThemeConfig' API endpoint. This allows the execution of payloads for all site visitors, which can lead to session hijacking, cookie theft, or phishing.

Recommendations Update to a version later than 1.7.4. As a temporary workaround, restrict access to the 'saveThemeConfig' API endpoint or avoid using the custom html field in the theme configuration.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-37503

Affected Products

V2Board

References · 6

• 🔥 https://gist.github.com/sgInnora/1330e1a82caa79906eec55eeff2c99b9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37503 · Security Note
• https://github.com/v2board/v2board · Note
• https://t.me/cveNotify/163082 · Telegram Post
• https://twitter.com/CVEnew/status/2050254032594223263 · Twitter Post
• https://t.me/cveNotify/162566 · Telegram Post