A flaw in the edit-category.php page of the Simple IT Discussion Forum allows an attacker to inject arbitrary script by manipulating the Category parameter. This cross‑site scripting (XSS) flaw enables the execution of malicious code in the browsers of users who view the affected page. As a result, attackers could deface pages, steal authentication cookies, or perform social‑engineering attacks against visitors.

The vulnerability is present in code‑projects Simple IT Discussion Forum version 1.0. Any deployment running this exact release and exposing the edit‑category.php endpoint is susceptible. The issue does not appear in later releases, but no evidence exists regarding other versions, so teams should confirm the version installed.

The CVSS v3 score of 5.3 indicates a moderate severity with potential impact on confidentiality, integrity, or availability of client‑side data. The exploit has already been published and is remotely exploitable; however, an EPSS score is not provided and the flaw is not listed in the CISA KEV catalog. Attackers can trigger the flaw by accessing edit‑category.php with a crafted Category GET or POST parameter, which suggests the attack vector is remote request from an unauthenticated or authenticated user. Accordingly, the risk remains significant until mitigated.