CVE-2021-28968: GNU Punbb

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.

Affected products

• GNU Punbb: before 1.4.6 (fixed in 1.4.6)

Published 2021-03-22. Last modified 2026-06-17.