| Package | Affected versions | Patched versions |
|---|---|---|
| v2board | ≤ 1.7.4 |
Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free