Which versions of Java are affected by CVE-2026-4495?

CVE-2026-4495 is a low-severity vulnerability in A security flaw involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2026-4495?

Yes, a public proof-of-concept exploit is available for CVE-2026-4495. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4495?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Java CVE-2026-4495

Q: What is the CVSS score of CVE-2026-4495?

CVE-2026-4495 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13758 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 VulDB

XSS Java Pybbs

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:11 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:11 NVD

5.1 (MEDIUM) 2.0 (LOW)

Severity Changed

Apr 22, 2026 - 21:37 NVD

LOW MEDIUM

CVSS changed

Apr 22, 2026 - 21:37 NVD

3.5 (LOW) 5.1 (MEDIUM)

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 18:15 euvd

EUVD-2026-13758

Analysis Generated

Mar 20, 2026 - 18:15 vuln.today

CVE Published

Mar 20, 2026 - 18:02 nvd

LOW 3.5

DescriptionCVE.org

A security flaw has been discovered in atjiu pybbs 6.0.0. This impacts the function create of the file src/main/java/co/yiiu/pybbs/controller/api/CommentApiController.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in atjiu pybbs 6.0.0 within the CommentApiController.java file's create function, allowing authenticated attackers to inject malicious scripts that execute in the browsers of other users viewing comments. The vulnerability requires user interaction (UI:R per CVSS vector) but carries a low CVSS score of 3.5 due to low impact scope; however, a public proof-of-concept exploit is available and the vulnerability has been disclosed, increasing real-world exploitation risk despite the low severity rating.

Technical ContextAI

The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in a Java-based web application. The atjiu pybbs platform (identified via CPE cpe:2.3:a:atjiu:pybbs) is a community discussion or bulletin board system where the CommentApiController handles user-submitted comments. The root cause is insufficient input validation and output encoding in the create function, allowing user-supplied data to be stored and later rendered without proper HTML/JavaScript escaping. This is a classic stored XSS where attacker input persists in the database and affects all subsequent viewers of the comment.

RemediationAI

The primary remediation is to upgrade atjiu pybbs beyond version 6.0.0 to a patched release if available from the atjiu project maintainers. Users should consult the official pybbs GitHub repository or vendor security advisories for patch availability and timelines. Until patching is feasible, implement the following interim controls: (1) Apply input validation and output encoding in the CommentApiController create function to sanitize user-supplied comment text, ensuring all HTML special characters are properly escaped before database storage and rendering; (2) Implement a Web Application Firewall (WAF) rule set to detect and block common XSS payloads in comment submissions; (3) Enforce Content Security Policy (CSP) headers with script-src restrictions to mitigate XSS impact; (4) Restrict the comment API endpoint to trusted networks or IP ranges if possible. Reference VulDB submission https://vuldb.com/?submit.773780 for additional technical details.