CyberSecBulletin

V2board vulnerabilities

We track 2 vulnerabilities in V2board products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 1, 2026.

2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score

Latest V2board vulnerabilities

  • 7.5 High severity

    V2board: Use of HTTP Request With Sensitive Query String

    CVE-2026-37504V2board

    Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy

  • 9.1 Critical severity

    v2board: Insertion of Sensitive Information Into Sent Data

    CVE-2026-39912V2board

    V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with_mail_link_enable feature is active. Unauthenticated attackers can POST to the loginWithMailLink endp