CVE-2023-36222

MediumCVSS 5.4

Published: 03/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

43th percentile - higher than 43% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.

Risk Assessment

The risk involves injection of malicious scripts that may execute in other users' browsers, leading to session theft, redirects, or other harmful actions.

Recommendation

Immediately upgrade bbs-go to a version later than 3.5.5 and implement input validation and sanitization for the comment parameter.

Original NVD description (English source)

Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.