CVE-2023-36222
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.
Risk Assessment
The risk involves injection of malicious scripts that may execute in other users' browsers, leading to session theft, redirects, or other harmful actions.
Recommendation
Immediately upgrade bbs-go to a version later than 3.5.5 and implement input validation and sanitization for the comment parameter.
Other vulnerabilities in bbs-go
See all- CVE-2026-103396Medium
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.
- CVE-2023-36223Medium
A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.
Original NVD description (English source)
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS