Is there a public PoC exploit available for EUVD-2026-26811?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26811. Prioritise patching immediately. EPSS: 0.0%.

kerwincui FastBee EUVD-2026-26811

Q: What is the CVSS score of EUVD-2026-26811?

EUVD-2026-26811 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7677 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-05-03 VulDB

Java XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

May 03, 2026 - 05:22 NVD

3.5 (LOW) 2.0 (LOW)

PoC Detected

May 03, 2026 - 05:15 vuln.today

Public exploit code

Analysis Generated

May 03, 2026 - 05:00 vuln.today

EUVD ID Assigned

May 03, 2026 - 04:30 euvd

EUVD-2026-26811

Analysis Generated

May 03, 2026 - 04:30 vuln.today

CVE Published

May 03, 2026 - 03:15 nvd

LOW 2.0

DescriptionCVE.org

A vulnerability was determined in kerwincui FastBee up to 1.2.1. The impacted element is the function Add of the file springboot/fastbee-admin/src/main/java/com/fastbee/web/controller/system/SysNoticeController.java of the component System Notice Handler. This manipulation of the argument noticeContent causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting (XSS) in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to inject malicious scripts via the noticeContent parameter in the System Notice Handler component, which are then executed in the browsers of other users viewing notices. The vulnerability requires user interaction (victims must view the injected notice) and authenticated access, limiting immediate attack scope, though publicly available exploit code and vendor non-responsiveness increase real-world risk.

Technical ContextAI

The vulnerability exists in the SysNoticeController.java file within the springboot/fastbee-admin module, specifically in the Add function that processes the noticeContent parameter. The root cause is improper input validation and output encoding for user-supplied content in the System Notice Handler component, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The affected CPE is a:kerwincui:fastbee:* (all versions through 1.2.1), indicating the flaw affects the core FastBee administrative interface. The Java-based Spring Boot application fails to sanitize or encode the noticeContent field before storing it in the database and rendering it to other authenticated users, creating a stored XSS vector.

RemediationAI

No vendor-released patch is available, as the vendor did not respond to early disclosure contact. Immediate mitigations include: (1) Upgrade to a version newer than 1.2.1 if available from an alternative source or fork, though this is not confirmed; (2) Implement input validation and output encoding for the noticeContent parameter at the application level by modifying SysNoticeController.java to sanitize all user-supplied content using a whitelist-based HTML sanitizer (e.g., OWASP AntiSamy, DOMPurify) before storage and encoding output using context-appropriate encoding (e.g., HTML entity encoding) before rendering; (3) Restrict access to the System Notice Handler to a minimal set of trusted administrators and implement strict role-based access control; (4) Deploy a Web Application Firewall (WAF) with rules to detect and block common XSS payloads in the noticeContent parameter; (5) Audit the database for existing malicious notices and purge them. Consider migrating to an actively maintained alternative if FastBee is mission-critical, given vendor abandonment.