phpBB CVE-2026-87901

Exploitation targets phpBB's registration module and requires a victim to interact - specifically to open an attacker-crafted link containing the XSS payload (CVSS UI:R) - because the flaw is reflected (non-persistent), not stored. No authentication is required of the attacker (PR:N), but the reflected nature means each victim must be individually lured, and the payload runs only in that victim's browser session rather than compromising the server directly. The exact unsanitized parameter and whether any specific registration configuration must be enabled are not described in the available sources.

This is a CWE-79 reflected Cross-Site Scripting flaw in phpBB's registration module. The supplied CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L, 8.3) indicates a network-reachable, low-complexity, unauthenticated attack that requires victim user interaction. However, the impact metrics appear inflated for a reflected XSS: an unchanged scope (S:U) combined with C:H/I:H is internally inconsistent, since reflected XSS typically executes in the victim's browser context (a scope change) with limited, not high, confidentiality/integrity impact - this is a likely over-scoring that should be verified. Key exploitation signals are MISSING or weak: no EPSS score was provided, the vulnerability is NOT in CISA KEV, and the single reference is a phpBB community forum topic rather than confirmed exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a credible but non-actively-exploited web flaw. Net: this is a legitimate, patch-worthy forum-software XSS requiring user interaction, but not a drop-everything emergency - the headline 8.3 overstates real-world risk relative to the missing exploitation evidence.

An unauthenticated attacker crafts a malicious URL targeting the phpBB registration module with an embedded script payload, then lures a forum visitor into clicking it (e.g., via phishing or a forum post). When the victim loads the link, the unsanitized input is reflected into the page and executes in the victim's browser, enabling session/cookie theft or actions in the victim's authenticated context. No confirmed public exploit code was identified; the only reference is a phpBB community forum topic whose status as working exploit code is not verified.