CVE-2021-26628: MaxBoard XSS and File Upload Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-26 · updated 2026-06-17
Weakness: CWE-79

Description

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.

Affected products

MaxBoard: before 1.9.6.1 — fixed in 1.9.6.1

How to fix

Upgrade to a fixed version: MaxBoard 1.9.6.1. Check the vendor advisory for mitigations.

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66673
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66673

Get alerted when CVE-2021-26628 or the next vulnerability affects your stack