Threats affecting pkg:maven/atjiu/pybbs

CVE-2026-4495 is a medium severity cross-site scripting (XSS) vulnerability found in atjiu pybbs version 6.0.0, specifically in the create function of CommentApiController.java. The flaw allows remote attackers to inject malicious scripts without requiring authentication, though user interaction is needed to trigger the payload. Exploit code has been publicly released, increasing the risk of exploitation. This vulnerability can lead to theft of user credentials, session hijacking, and unauthorized actions performed in the context of a victim user. No official patch is currently available, so mitigation relies on input validation and output encoding. Organizations using pybbs 6.0.

A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.