Skip to main content

UBB.threads CVE-2026-54221

| EUVDEUVD-2026-37884 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-06-18 CERT-PL GHSA-9c46-2jjw-rj67
XSS Ubb Threads
5.1
CVSS 4.0 · Vendor: CERT-PL
Share

Severity by source

Vendor (CERT-PL) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.1 MEDIUM

Network-delivered reflected XSS requires victim interaction (UI:R), crosses scope boundary into victim browser (S:C), with low C/I impact; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 18, 2026 - 13:34 vuln.today

DescriptionCVE.org

UBB.threads is vulnerable to Reflected XSS. The application improperly handles user input in certain requests, enabling attackers to execute arbitrary JavaScript in the context of a victim's browser by tricking them into clicking a crafted link. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 7.7.5 but may also affect other versions.

AnalysisAI

Reflected XSS in UBB.threads 7.7.5 enables remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing malicious input. The vulnerability stems from improper handling of user-supplied data in HTTP requests, with impact scoped to the victim's browser session rather than the server itself. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Identify vulnerable UBB.threads parameter
Delivery
Craft malicious reflected XSS URL
Exploit
Deliver link to target victim
Install
Victim clicks link, browser sends tainted request
C2
Server reflects payload unsanitized
Execute
JavaScript executes in victim's browser context
Impact
Exfiltrate session token or perform authenticated actions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The victim must click a crafted link delivered by the attacker - exploitation cannot occur passively without user interaction (UI:A in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 5.1 is consistent with a medium-severity reflected XSS requiring active victim participation (UI:A), which significantly reduces mass-exploitation potential compared to stored or DOM-based variants. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a URL parameter in UBB.threads that is reflected unsanitized into the HTML response, constructs a crafted link embedding a JavaScript payload (e.g., a cookie-stealing script), and distributes it to forum users via private message, email, or an external site. When a logged-in victim clicks the link, their browser executes the injected script in the context of the UBB.threads origin, potentially exfiltrating session cookies or performing actions on their behalf. …
Remediation No vendor-released patch has been identified at time of analysis; vendor contact attempts by CERT-PL were unsuccessful, and no advisory was published at https://www.ubbcentral.com/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ubb Threads

View all
CVE-2012-5104 MEDIUM POC
4.3 Sep 23

Cross-site scripting (XSS) vulnerability in forums/ubbthreads.php in UBB.threads 7.5.6 and earlier allows remote attacke
CVE-2026-54223 HIGH
8.6 Jun 18

Remote code execution in UBB.threads forum software (version 7.7.5 confirmed) is achievable by authenticated users holdi
CVE-2026-54222 HIGH
8.6 Jun 18

Authenticated blind SQL injection in UBB.threads forum software version 7.7.5 (and likely other versions) allows adminis
CVE-2026-54220 HIGH
8.6 Jun 18

Cross-site request forgery in UBB.threads forum software version 7.7.5 (and potentially earlier versions) allows remote

CVE-2026-54224 HIGH
7.1 Jun 18

Database-resource exhaustion in UBB.threads forum software (confirmed in version 7.7.5) allows an authenticated low-priv
CVE-2026-54219 MEDIUM
5.1 Jun 18

Stored XSS in UBB.threads 7.7.5 permits low-privileged forum members to permanently inject arbitrary JavaScript into pos

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2026-54221 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy