Threats tagged 'ghsa-4jxj-79x3-676q'

CVE-2026-37503 is a Cross-Site Scripting (XSS) vulnerability in V2Board versions through 1.7.4. It arises from the custom_html field in theme configuration being rendered without escaping in the dashboard template. An administrator can inject arbitrary JavaScript via the saveThemeConfig API, which executes in the browsers of all site visitors. This can lead to cookie theft, session hijacking, or phishing attacks.