Which versions of Java are affected by CVE-2026-4494?

CVE-2026-4494 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2026-4494?

Yes, a public proof-of-concept exploit is available for CVE-2026-4494. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4494?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Java CVE-2026-4494

Q: What is the CVSS score of CVE-2026-4494?

CVE-2026-4494 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13756 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 VulDB

XSS Java Pybbs

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

Severity Changed

Apr 22, 2026 - 21:37 NVD

LOW MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

3.5 (LOW) 5.1 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 17:45 euvd

EUVD-2026-13756

Analysis Generated

Mar 20, 2026 - 17:45 vuln.today

CVE Published

Mar 20, 2026 - 17:32 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability was identified in atjiu pybbs 6.0.0. This affects the function create of the file src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

AnalysisAI

A stored cross-site scripting (XSS) vulnerability exists in atjiu pybbs 6.0.0 within the TopicApiController.java create function that allows authenticated attackers to inject malicious scripts into topic creation requests. The vulnerability affects all versions of the pybbs application matching the CPE cpe:2.3:a:atjiu:pybbs:*:*:*:*:*:*:*:*, and while the CVSS score of 3.5 is low, a publicly available proof-of-concept exploit has been disclosed, indicating active research and potential real-world exploitation risk.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), which occurs when user-supplied input is not properly sanitized before being reflected or stored in web content. Specifically, the create function in src/main/java/co/yiiu/pybbs/controller/api/TopicApiController.java fails to implement adequate input validation or output encoding when processing topic creation requests. The pybbs application is a Java-based bulletin board system (identified via CPE cpe:2.3:a:atjiu:pybbs), and the vulnerability resides in the API controller layer where user input is processed server-side without proper escaping before storage or rendering. This allows attackers to inject arbitrary JavaScript code that executes in the context of other users' browsers when the malicious content is displayed.

RemediationAI

Immediately upgrade atjiu pybbs to a patched version if available from the upstream project, or contact the atjiu project maintainers at their GitHub repository for security update information. Until a patch is released, implement input validation and output encoding on all user-submitted content in the TopicApiController.create() method—specifically, use HTML entity encoding (e.g., OWASP ESAPI or Spring Security's built-in encoding) for all topic titles and content before storage and rendering. Additionally, implement a Content Security Policy (CSP) header to restrict script execution and enforce same-origin policies. For critical deployments, consider temporarily disabling the topic creation API endpoint or restricting access to trusted IP ranges via firewall rules while awaiting upstream patches. The publicly available exploit (referenced at https://fx4tqqfvdw4.feishu.cn/docx/EKVgdqWIzo70C0xB5jxcb4IZnre?from=from_copylink) should be used to validate remediation effectiveness in a test environment.