bbs-go
by mlogclub
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-111639 | Hig | 0.46 | 8.1 | 0.00 | Oct 16, 2026 | bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can… | ||
| CVE-2026-121452 | Med | 0.35 | 6.5 | — | Nov 3, 2026 | bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and… | ||
| CVE-2023-36223 | Med | 0.35 | 5.4 | 0.01 | Jul 3, 2023 | Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function. | ||
| CVE-2023-36222 | Med | 0.35 | 5.4 | 0.01 | Jul 3, 2023 | Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function. | ||
| CVE-2021-38221 | Med | 0.35 | 5.4 | 0.01 | Jun 2, 2022 | bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS. | ||
| CVE-2026-110103 | Med | 0.28 | 5.4 | 0.00 | Oct 13, 2026 | bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their… | ||
| CVE-2026-103396 | Med | 0.21 | 4.3 | 0.00 | Sep 30, 2026 | bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users… |
- risk 0.46cvss 8.1epss 0.00
bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by submitting Google ID tokens issued to any OAuth client. Attackers operating their own Google OAuth client can…
- risk 0.35cvss 6.5epss —
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and…
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the announcements parameter in the settings function.
- risk 0.35cvss 5.4epss 0.01
Cross Site Scripting vulnerability in mlogclub bbs-go v. 3.5.5. and before allows a remote attacker to execute arbitrary code via a crafted payload to the comment parameter in the article function.
- risk 0.35cvss 5.4epss 0.01
bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.
- risk 0.28cvss 5.4epss 0.00
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their…
- risk 0.21cvss 4.3epss 0.00
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users…