CVE-2026-110103
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spo
CVSS
5.4
Medium
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Published: Oct 13, 2026 · Last modified: Oct 16, 2026 · CWE-79
0.2%EPSS · 30 days0.2%
2026-10-142026-10-22
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin.
- github.comhttps://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/handlers/api/upload_handlers.go#L36-L54
- github.comhttps://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/pkg/uploader/uploader.go#L90-L121
- github.comhttps://github.com/mlogclub/bbs-go/commit/5bebf98bb9e0ac5162d4f8faf7a65fc0d496a362
- github.comhttps://github.com/mlogclub/bbs-go/issues/305
- github.comhttps://github.com/mlogclub/bbs-go/pull/306
- www.vulncheck.comhttps://www.vulncheck.com/advisories/bbs-go-through-4.4.6-stored-xss-via-image-upload-content-type
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1152463.5 LOW—
——0A weakness has been identified in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file patdocmsg.php. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.19hCVE-2026-1123137.1 HIG—
——0Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF Extended acf-extended allows Stored XSS.This issue affects ACF Extended: from n/a through 0.9.2.7.19hCVE-2024-583946.1 MED—
——0Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.23hCVE-2023-544136.1 MED—
——0WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplying crafted input in the wp_lang parameter. Attackers can lure users to /wp-login.php with a wp_lang value injecting an image input with an obfuscated onfocus handler to execute JavaScript in the victim's browser. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-11-12.23hCVE-2020-372846.1 MED—
——0Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming handler returns unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.23hCVE-2017-202906.1 MED—
——0Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the email parameter of /email/unsubscribed. Attackers can craft GET requests with SVG onload payloads, which unsubscribed.html.erb renders unescaped via html_safe, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.23h