Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-39912

v2board / Xboard Authentication Token Exposure via loginWithMailLink

V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endpoint with a known email address to receive the full authentication URL in the response, then exchange the token at the token2Login endpoint to obtain a valid bearer token with complete account access including admin privileges.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Cedar2025 V2board
Products
Xboard V2board
CVE-2026-37505

SQL Injection via ORDER BY in V2Board Admin User Sorting

SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
V2board
Products
V2board
CVE-2026-37504

Token Exposure via GET Parameters in V2Board

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs, browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
V2board
Products
V2board
CVE-2026-37503

Cross‑Site Scripting via Unescaped Theme Configuration in V2Board 1.7.4

Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
V2board
Products
V2board