What is the CVSS score of CVE-2026-36763?

CVE-2026-36763 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

SpringBlade CVE-2026-36763

EUVD-2026-26398 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-30 mitre

XSS N A

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 30, 2026 - 20:30 vuln.today

CVSS changed

Apr 30, 2026 - 18:22 NVD

6.1 (MEDIUM)

EUVD ID Assigned

Apr 30, 2026 - 18:00 euvd

EUVD-2026-26398

Analysis Generated

Apr 30, 2026 - 18:00 vuln.today

CVE Published

Apr 30, 2026 - 00:00 nvd

MEDIUM 6.1

DescriptionCVE.org

A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted input into the content parameter.

AnalysisAI

Stored cross-site scripting (XSS) in SpringBlade v4.8.0 allows unauthenticated remote attackers to inject arbitrary web scripts or HTML via the /api/blade-desk/notice/submit endpoint's content parameter, executing malicious code in the browsers of subsequent users who view the injected notice. The vulnerability requires user interaction (viewing the stored payload) to trigger, affecting the confidentiality and integrity of affected applications. No public exploit code or active exploitation has been confirmed at the time of analysis.

Technical ContextAI

SpringBlade is a Java-based web application framework. The vulnerability exists in the notice submission API endpoint (/api/blade-desk/notice/submit), which accepts user-supplied input via the content parameter without proper input validation or output encoding. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic stored XSS flaw. The injected payload is stored server-side and executed in the browser context of any user who retrieves and displays the malicious notice, typically with the privileges of that user's session. The vulnerability affects the notice management module of SpringBlade, a component used for system notifications.

RemediationAI

Upgrade SpringBlade to a patched version released by the vendor after v4.8.0. Consult the official SpringBlade GitHub repository (https://github.com/chillzhuang/SpringBlade) and project releases for the specific patched version number. If an immediate upgrade is not feasible, implement input validation and output encoding on the /api/blade-desk/notice/submit endpoint: sanitize the content parameter to remove or escape HTML and JavaScript metacharacters before storage, and apply context-appropriate output encoding (HTML entity encoding) when rendering notice content in browser responses. Additionally, implement a Content Security Policy (CSP) header restricting script execution to trusted sources, which will mitigate the impact of any stored XSS payloads that bypass input validation. Disable or restrict access to the notice submission API to authenticated administrative users only, reducing the attack surface from unauthenticated remote attackers. Test all mitigations against XSS payload variations before production deployment.