CVE-2026-2947

LOW

rymcu forest <= 0.0.5 - Cross-Site Scripting in User Profile Handler

Title source: llm
STIX 2.1

Description

A vulnerability was detected in rymcu forest up to 0.0.5. This affects the function updateUserInfo of the file - src/main/java/com/rymcu/forest/web/api/user/UserInfoController.java of the component User Profile Handler. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.347317
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.347317
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.755039

Scores

CVSS v3 3.5
EPSS 0.0028
EPSS Percentile 19.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
rymcu/forest < 0.0.5
Published Feb 22, 2026
Tracked Since Feb 22, 2026