CVE-2026-4816

Reflected Cross Site Scripting (XSS) vulnerability in Support Board

State: Published
Severity: 4.8 Medium
Published: Mar 25, 2026
Updated: Mar 25, 2026
Reserved: Mar 25, 2026

Description

A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/supportboard/include/articles.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N	INCIBE

Weaknesses

CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')

Affected Products

Product	Versions
Support BoardSchiocco	3.7.7 and earlierAffected 3.7.8Not affected

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-support-board-schioccopatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.