Support Board

Support Board has 12 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2026; all 12 are fixed as of September 2026. Their average CVSS score is 8.0, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 3 high. 2025 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (42%). Other recurring categories include SQL Injection, Authorization Bypass Through User-Controlled Key.

Every one of the 12 issues recorded for Support Board has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (2) reported by Foxyyy.

Strategic Overview

Avg CVSSHigh

8.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Support Board vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-27395

Support Board < 3.8.9 - Unauthenticated Privilege Escalation

Read the full analysis

Vulnerability Records

12 records


2026-06-01 00:00	Support Board < 3.8.9 - Unauthenticated Privilege Escalation Support Board < 3.8.9	`CVE-2026-27395`	9.8 Critical	Phat RiO	Yes
2025-07-31 00:00	Support Board < 3.8.7 - Reflected Cross-Site Scripting Support Board < 3.8.7	`CVE-2025-60182`	6.1 Medium	Trương Hữu Phúc (truonghuuphuc)	Yes
2025-07-23 00:00	Support Board <= 3.8.0 - Reflected Cross-Site Scripting Support Board <= 3.8.0	`CVE-2025-54027`	6.1 Medium	Tran Nguyen Bao Khanh	Yes
2025-07-22 00:00	Support Board <= 3.8.0 - Unauthenticated Local File Inclusion Support Board <= 3.8.0	`CVE-2025-54031`	8.1 High	Tran Nguyen Bao Khanh	Yes
2025-07-08 10:43	Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion Support Board <= 3.8.0	`CVE-2025-4828`	9.8 Critical	Foxyyy	Yes
2025-07-08 10:43	Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key Support Board <= 3.8.0	`CVE-2025-4855`	9.8 Critical	Foxyyy	Yes
2022-01-19 00:00	Support Board <= 3.4.1 - Authenticated SQL Injection Support Board < 3.4.2	`N/A`	8.8 High	zhangxf	Yes
2021-10-18 00:00	Support Board < 3.3.6 - Cross-Site Request Forgery Support Board < 3.3.6	`CVE-2021-24823`	8.1 High	Brandon James Roldan (tomorrowisnew)	Yes
2021-10-07 00:00	Support Board <= 3.3.4 - Agent+ Stored Cross-Site Scripting Support Board <= 3.3.4	`CVE-2021-24807`	6.4 Medium	John Jefferson Li	Yes
2021-09-03 00:00	Support Board <= 3.3.3 - Multiple Unauthenticated SQL Injections Support Board <= 3.3.3	`CVE-2021-24741`	9.8 Critical	John Jefferson Li	Yes

Showing 1–10 of 12 reports