{"affected":[{"defaultStatus":"unaffected","product":"phpBB","source":"CNA: hackerone","vendor":"phpBB","versions":[{"lessThanOrEqual":"3.3.18","status":"affected","version":"3.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-87901","cwes":["CWE-79"],"description":"Improper sanitization in the registration module allows reflected Cross-Site Scripting.","epss":{"date":"2026-11-02","percentile":0.25269,"score":0.00322},"exploits":[],"kev":null,"metrics":[{"score":8.3,"severity":"high","source":"CNA: hackerone","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.0"},{"score":8.3,"severity":"high","source":"NVD: support@hackerone.com","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.0"}],"modifiedAt":1793636264763,"publishedAt":1792772105780,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://www.phpbb.com/community/viewtopic.php?t=2675305"},{"source":"support@hackerone.com","tags":[],"url":"https://www.phpbb.com/community/viewtopic.php?t=2675305"}],"remediation":[],"revision":"593d804233a172e2faea4d46c0825254d616d8967cef565f385f9bb6c2e40078","sources":[{"modifiedAt":1793633880796,"name":"CNA: hackerone","retrievedAt":1793635791916,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87901"},{"modifiedAt":1793636264763,"name":"NVD","retrievedAt":1793643425760,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87901"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793635805542,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87901"}],"ssvc":{"assessedAt":1793633845670,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2026-87901","updatedAt":1793643425760}