CVE-2026-90563
Received Received - Intake

Cross-Site Scripting in BBS-SpringBoot 3.0.0

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90563
EUVD
EUVD-2026-77032

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
maliangnansheng bbs-springboot to 3.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the NansBBS 3.0.0 application. It occurs in the article Markdown table of contents rendering function. User-submitted markdown or HTML content is stored in the database without sanitization. When the table of contents is regenerated and rendered using Vue's v-html directive, malicious scripts execute. The issue stems from improper handling of user input in the ArticleController.java file's utils.toToc function.

Detection Guidance

To detect this vulnerability, inspect the ArticleController.java file for the utils.toToc function handling user-submitted HTML content. Check if the application stores raw HTML in MongoDB via POST /api/bbs/article/create or POST /api/bbs/article/update endpoints. Review Vue components like MarkdownToc.vue for v-html usage that renders untrusted content.

Impact Analysis

An attacker with basic permissions can submit crafted content containing malicious scripts. This payload is stored in the database and later rendered in the table of contents for other users, including administrators. The attack affects multiple user roles across the application, not just the submitter. It enables theft of session cookies, account takeover, or defacement of the forum interface.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The lack of input sanitization and stored XSS may result in data breaches, unauthorized disclosure, or integrity violations, triggering compliance violations and potential regulatory penalties.

Mitigation Strategies

Immediately sanitize all user-submitted HTML content before storage. Regenerate HTML from trusted markdown on the server side. Replace v-html with v-text in Vue templates to prevent script execution. Implement strict input validation for article content and directory identifiers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90563. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart