What is the CVSS score of CVE-2026-37503?

CVE-2026-37503 has a CVSS 3.1 base score of 6.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

V2Board CVE-2026-37503

EUVD-2026-26667 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-01 mitre

PHP XSS

6.9

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 16:00 vuln.today

EUVD ID Assigned

May 01, 2026 - 15:45 euvd

EUVD-2026-26667

Analysis Generated

May 01, 2026 - 15:45 vuln.today

CVE Published

May 01, 2026 - 00:00 nvd

MEDIUM 6.9

DescriptionNVD

Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing.

AnalysisAI

Stored cross-site scripting in V2Board through version 1.7.4 allows authenticated administrators to inject arbitrary JavaScript into the custom_html theme configuration field via the saveThemeConfig API, which is rendered unescaped in the dashboard.blade.php template and executed in the browsers of all site visitors, enabling cookie theft, session hijacking, and phishing attacks.

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-37503 vulnerability details – vuln.today

Back