UBB.threads CVE-2026-54221

Q: What is the CVSS score of CVE-2026-54221?

CVE-2026-54221 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37884 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-18 CERT-PL

GHSA-9c46-2jjw-rj67

XSS Ubb Threads

5.1

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered reflected XSS requires victim interaction (UI:R), crosses scope boundary into victim browser (S:C), with low C/I impact; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 13:34 vuln.today

DescriptionCVE.org

UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling attackers to execute arbitrary JavaScript in the context of a victim's browser by tricking them into clicking a crafted link. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

AnalysisAI

Reflected XSS in UBB.threads 7.7.5 enables remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing malicious input. The vulnerability stems from improper handling of user-supplied data in HTTP requests, with impact scoped to the victim's browser session rather than the server itself. No public exploit code or active exploitation has been identified at time of analysis; vendor contact was unsuccessful, leaving patch status unresolved.

Technical ContextAI

UBB.threads is a PHP-based internet forum and bulletin board platform developed by UBB Systems, identified via CPE cpe:2.3:a:ubb_systems:ubb.threads:*:*:*:*:*:*:*:*. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically the reflected variant, where attacker-controlled input submitted via HTTP request parameters is echoed back to the response without adequate output encoding or sanitization. Because the malicious payload is not stored server-side, exploitation requires each victim to be individually lured into sending the tainted request, typically via a crafted hyperlink. The CVSS 4.0 vector reflects a scope boundary: the vulnerable system (server) registers no direct CIA impact (VC:N/VI:N/VA:N), while the subsequent system - the victim's browser session - sustains low confidentiality and integrity impact (SC:L/SI:L).

RemediationAI

No vendor-released patch has been identified at time of analysis; vendor contact attempts by CERT-PL were unsuccessful, and no advisory was published at https://www.ubbcentral.com/. The CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-54219 (note: URL references CVE-2026-54219 - verify relationship to CVE-2026-54221) provides the primary public disclosure. Until a vendor patch is available, administrators should deploy a Web Application Firewall (WAF) rule set to detect and block reflected XSS payloads in query parameters and form fields - note that WAF rules may produce false positives on legitimate forum markup. Implementing a strict Content Security Policy (CSP) header (e.g., script-src 'self') on all UBB.threads responses will prevent injected scripts from executing even if bypass occurs, though this may break forum features that rely on inline scripts. Operators should also consider restricting access to the affected instance to trusted networks pending a vendor fix, accepting the trade-off of reduced public accessibility.