Vulnerabilidades de V2board
CVEs publicadas que afetam produtos de V2board: 4 registro(s), com severidade, exploração e correções.
CVE-2026-37505
Média · 4.9
CWE-89 01/05/2026
SQL Injection em V2board
SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remember_token, and other sensitive fields, enabling information disclosure through ordering analysis.
CVE-2026-37504
Alta · 7.5
CWE-598 01/05/2026
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In…
Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be recorded in web server access logs, browser history, HTTP Referer headers, and proxy/CDN logs. An attacker who gains access to any log source can extract the token and impersonate a proxy server node, potentially intercepting all user traffic.
CVE-2026-37503
Média · 4.8
CWE-79 01/05/2026
Cross-site Scripting (XSS) em V2board
Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling cookie theft, session hijacking, or phishing.
CVE-2026-39912
Crítica · 9.1
CWE-201 09/04/2026
Exposição de token de autenticação no loginWithMailLink do V2Board e Xboard
O V2Board 1.6.1 até 1.7.4 e o Xboard até 0.1.9 expõem tokens de autenticação nos corpos de resposta HTTP do endpoint loginWithMailLink quando o recurso login_with_mail_link_enable está ativo. Atacantes não autenticados podem fazer POST para o endpoint loginWithMailLink com um endereço de e-mail conhecido para receber na resposta a URL de autenticação completa, e então trocar o token no endpoint token2Login para obter um bearer token válido com acesso completo à conta, incluindo privilégios de administrador.