Live › vulnerability › CVE-2026-87901
Go to dashboardThe registration module does not sanitize input, so a crafted link can make it reflect script back to the visitor. An attacker who gets a victim to open that link can run script in the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any phpBB forum running 3.3.0 through 3.3.18 with the registration page reachable. An attacker sends a crafted link to a registration page and the script runs in the visitor's browser, which is most dangerous for admins and moderators who are logged in. Forums already on 3.3.19 can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| phpBB | vendor | >= 3.3.0, <= 3.3.18 | 3.3.19 |
3.3.0 through 3.3.18 is exposed; 3.3.19 is fixedUpdate phpBB to 3.3.19 (released 2026-09-24). 3.3.18 packages did not contain the fix; do not stop at 3.3.18.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper sanitization in the registration module allows reflected Cross-Site Scripting.
This page as .md · .json · in your agent: get_signal("CVE-2026-87901")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.