CVE-2023-34461

PyBB is an open source bulletin board. A manual code review of the PyBB bulletin board server has revealed that a vulnerability could have been exploited in which users could submit any type of HTML tag, and have said tag run. For example, a malicious `<a>` that looks like ```<a href=javascript:alert (1)>xss</a>``` could have been used to run code through JavaScript on the client side. The problem has been patched as of commit `5defd92`, and users are advised to upgrade. Attackers do need posting privilege in order to exploit this vulnerability. This vulnerability is present within the 0.1.0 release, and users are advised to upgrade to 0.1.1. Users unable to upgrade may be able to work around the attack by either; Removing the ability to create posts, removing the `|safe` tag from the Jinja2 template titled "post.html" in templates or by adding manual validation of links in the post creation section.

• CWE-79

• https://github.com/benjjvi/PyBB/commit/5defd922ab05a193a783392d447c6538628cf854Patch
• https://github.com/benjjvi/PyBB/security/advisories/GHSA-mv96-w49p-438pMitigation, Patch, Third Party Advisory
• https://github.com/benjjvi/PyBB/commit/5defd922ab05a193a783392d447c6538628cf854Patch
• https://github.com/benjjvi/PyBB/security/advisories/GHSA-mv96-w49p-438pMitigation, Patch, Third Party Advisory

Published

Jun 19, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-34455snappy-java is a fast compressor/decompressor for Java. Due …7.5
• CVE-2023-34457MechanicalSoup is a Python library for automating interactio…7.5
• CVE-2023-34458mx-chain-go is the official implementation of the MultiversX…5.3
• CVE-2023-34459OpenZeppelin Contracts is a library for smart contract devel…5.9
• CVE-2023-3446Issue summary: Checking excessively long DH keys or paramete…5.3
• CVE-2023-34460Tauri is a framework for building binaries for all major des…9.8
• CVE-2023-34462Netty is an asynchronous event-driven network application fr…6.5
• CVE-2023-34463DataEase is an open source data visualization analysis tool …8.1
• CVE-2023-34464XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-34465XWiki Platform is a generic wiki platform. Starting in versi…8.1
• CVE-2023-34466XWiki Platform is a generic wiki platform offering runtime s…4.3
• CVE-2023-34467XWiki Platform is a generic wiki platform. Starting in versi…7.5