Live › vulnerability › CVE-2026-120190
PostyBirb Plus, a tool for posting art and submissions to websites, has a cross-site scripting flaw in its submission description editor. A remote attacker can have script run in the browser of a user who opens the crafted content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 01:47 UTC. All times on this page are UTC.
Teams running PostyBirb Plus up to version 3.1.75 where users edit submission descriptions. The sources do not say whether a default install exposes the editor to outside users, so the exposure depends on who can supply content to it.
No product ranges from the sources yet.
3.1.75.ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx in the installed source.3.1.76.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/DescriptionInput.tsx of the component Submission Description Editor. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.1.76 addresses this issue. The patch is identified as 6b11c2345ad98ae59fd5404a9f1024eb1d10c8a4. It is advisable to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-120190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.